Re: Telnetd Vulnerability Report

Ron Ben Yizhak <[email protected]> Sun, 22 Feb 2026 10:45:18 +0200
Newsgroups gmane.comp.gnu.inetutils.bugs
Message-ID <CAB1hGqRGgVz_+fhodhE6bU2UqO6FvE2booaV42bXeT-K3dqn_w@mail.gmail.com>
--0000000000001c34b1064b65ad1e
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi,

Great! Thank you for making this change.
What about the CVE?

Best regards,
Ron

On Thu, Feb 19, 2026 at 9:28=E2=80=AFPM Erik Auerswald <[email protected]=
i-kl.de>
wrote:

> Hi,
>
> I've just pushed the attribution change.
>
> Cheers,
> Erik
>
>
> On Wed, Feb 18, 2026 at 03:41:00PM +0200, Ron Ben Yizhak wrote:
> > Hi,
> >
> > That is perfect. Thank you!
> >
> > On Wed, Feb 18, 2026 at 3:21=E2=80=AFPM Erik Auerswald <
> [email protected]>
> > wrote:
> >
> > > Hi,
> > >
> > > I think it would be fine to adjust the attribution, would something
> like
> > > the following be OK?
> > >
> > > ----------------8<----------------
> > > diff --git a/NEWS.md b/NEWS.md
> > > index f5172a71..2d575efa 100644
> > > --- a/NEWS.md
> > > +++ b/NEWS.md
> > > @@ -8,7 +8,7 @@ improvements and security advisory by Simon Josefsson=
.
> > >
> > >  ** Prevent privilege escalation via telnetd abusing systemd service
> > >  credentials support added to the login(1) implementation of util-lin=
ux
> > > -in release 2.40.  Reported by Ron Ben Yizhak in
> > > +in release 2.40.  Reported by Ron Ben Yizhak@SafeBreach in
> > >  <
> https://lists.gnu.org/archive/html/bug-inetutils/2026-02/msg00000.html>.
> > >
> > >  ** telnet: Drop everything related to TN3270.
> > > diff --git a/THANKS b/THANKS
> > > index ef5f6063..f6e725f1 100644
> > > --- a/THANKS
> > > +++ b/THANKS
> > > @@ -10,7 +10,7 @@ In particular:
> > >    Nathan Neulinger       (tftpd)
> > >    Thomas Bushnell        (sockaddr sin_len field)
> > >    Kyu Neushwaistein      (reported remote root exploit in telnetd)
> > > -  Ron Ben Yizhak         (reported privilege escalation via telnetd)
> > > +  Ron Ben Yizhak@SafeBreach (reported privilege escalation via
> telnetd)
> > >
> > >  Please see version control logs and ChangeLog.? for full credits.
> > >
> > > ---------------->8----------------
> > >
> > > Any objections?
> > >
> > > Cheers,
> > > Erik
> > >
> > >
> > > On Mon, Feb 16, 2026 at 02:03:01PM +0200, Ron Ben Yizhak wrote:
> > > > Hi,
> > > >
> > > > Thank you for handling my report and fixing the vulnerability. As
> this
> > > > finding was done as part of my job at SafeBreach, it is very
> important
> > > for
> > > > us that SafeBreach will be mentioned in the patch.
> > > > Could you please change the THANKS and NEWS.md file to say Ron Ben
> > > > Yizhak@SafeBreach instead of Ron Ben Yizhak?
> > > >
> > > > Also, when will a CVE be assigned for this vulnerability?
> > > > Thank you,
> > > > Ron Ben Yizhak
> > > >
> > > > On Sun, Feb 15, 2026 at 7:21=E2=80=AFPM Erik Auerswald <
> > > [email protected]>
> > > > wrote:
> > > >
> > > > > Hi Simon,
> > > > >
> > > > > On Sun, Feb 15, 2026 at 04:36:56PM +0100, Simon Josefsson wrote:
> > > > > > Erik Auerswald <[email protected]> writes:
> > > > > >
> > > > > > > I plan to commit and push the attached patch in a few days to
> > > address
> > > > > > > this vulnerability, unless there are reasonable objections.
> > > > > >
> > > > > > Thanks -- I wish we could implement the --accept-env approach a=
nd
> > > make
> > > > > > the default not set any environment variables at all, but I don=
't
> > > have
> > > > > > cycles to work on that.  Anyone else?
> > > > >
> > > > > Me neither.
> > > > >
> > > > > > Your patch seems to close this vulnerability report in a most
> minimal
> > > > > > way, so IMHO we should apply it.
> > > > >
> > > > > I have just applied it.
> > > > >
> > > > > Cheers,
> > > > > Erik
>

--0000000000001c34b1064b65ad1e
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi,<br><br>Great! Thank you for making this change.<div>Wh=
at about the CVE?<br><br>Best regards,</div><div>Ron</div></div><br><div cl=
ass=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_a=
ttr">On Thu, Feb 19, 2026 at 9:28=E2=80=AFPM Erik Auerswald &lt;<a href=3D"=
mailto:[email protected]">[email protected]</a>&gt; wrote=
:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.=
8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi,<br>
<br>
I&#39;ve just pushed the attribution change.<br>
<br>
Cheers,<br>
Erik<br>
<br>
<br>
On Wed, Feb 18, 2026 at 03:41:00PM +0200, Ron Ben Yizhak wrote:<br>
&gt; Hi,<br>
&gt; <br>
&gt; That is perfect. Thank you!<br>
&gt; <br>
&gt; On Wed, Feb 18, 2026 at 3:21=E2=80=AFPM Erik Auerswald &lt;<a href=3D"=
mailto:[email protected]" target=3D"_blank">[email protected]=
l.de</a>&gt;<br>
&gt; wrote:<br>
&gt; <br>
&gt; &gt; Hi,<br>
&gt; &gt;<br>
&gt; &gt; I think it would be fine to adjust the attribution, would somethi=
ng like<br>
&gt; &gt; the following be OK?<br>
&gt; &gt;<br>
&gt; &gt; ----------------8&lt;----------------<br>
&gt; &gt; diff --git a/NEWS.md b/NEWS.md<br>
&gt; &gt; index f5172a71..2d575efa 100644<br>
&gt; &gt; --- a/NEWS.md<br>
&gt; &gt; +++ b/NEWS.md<br>
&gt; &gt; @@ -8,7 +8,7 @@ improvements and security advisory by Simon Josef=
sson.<br>
&gt; &gt;<br>
&gt; &gt;=C2=A0 ** Prevent privilege escalation via telnetd abusing systemd=
 service<br>
&gt; &gt;=C2=A0 credentials support added to the login(1) implementation of=
 util-linux<br>
&gt; &gt; -in release 2.40.=C2=A0 Reported by Ron Ben Yizhak in<br>
&gt; &gt; +in release 2.40.=C2=A0 Reported by Ron Ben Yizhak@SafeBreach in<=
br>
&gt; &gt;=C2=A0 &lt;<a href=3D"https://lists.gnu.org/archive/html/bug-inetu=
tils/2026-02/msg00000.html" rel=3D"noreferrer" target=3D"_blank">https://li=
sts.gnu.org/archive/html/bug-inetutils/2026-02/msg00000.html</a>&gt;.<br>
&gt; &gt;<br>
&gt; &gt;=C2=A0 ** telnet: Drop everything related to TN3270.<br>
&gt; &gt; diff --git a/THANKS b/THANKS<br>
&gt; &gt; index ef5f6063..f6e725f1 100644<br>
&gt; &gt; --- a/THANKS<br>
&gt; &gt; +++ b/THANKS<br>
&gt; &gt; @@ -10,7 +10,7 @@ In particular:<br>
&gt; &gt;=C2=A0 =C2=A0 Nathan Neulinger=C2=A0 =C2=A0 =C2=A0 =C2=A0(tftpd)<b=
r>
&gt; &gt;=C2=A0 =C2=A0 Thomas Bushnell=C2=A0 =C2=A0 =C2=A0 =C2=A0 (sockaddr=
 sin_len field)<br>
&gt; &gt;=C2=A0 =C2=A0 Kyu Neushwaistein=C2=A0 =C2=A0 =C2=A0 (reported remo=
te root exploit in telnetd)<br>
&gt; &gt; -=C2=A0 Ron Ben Yizhak=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0(reported=
 privilege escalation via telnetd)<br>
&gt; &gt; +=C2=A0 Ron Ben Yizhak@SafeBreach (reported privilege escalation =
via telnetd)<br>
&gt; &gt;<br>
&gt; &gt;=C2=A0 Please see version control logs and ChangeLog.? for full cr=
edits.<br>
&gt; &gt;<br>
&gt; &gt; ----------------&gt;8----------------<br>
&gt; &gt;<br>
&gt; &gt; Any objections?<br>
&gt; &gt;<br>
&gt; &gt; Cheers,<br>
&gt; &gt; Erik<br>
&gt; &gt;<br>
&gt; &gt;<br>
&gt; &gt; On Mon, Feb 16, 2026 at 02:03:01PM +0200, Ron Ben Yizhak wrote:<b=
r>
&gt; &gt; &gt; Hi,<br>
&gt; &gt; &gt;<br>
&gt; &gt; &gt; Thank you for handling my report and fixing the vulnerabilit=
y. As this<br>
&gt; &gt; &gt; finding was done as part of my job at SafeBreach, it is very=
 important<br>
&gt; &gt; for<br>
&gt; &gt; &gt; us that SafeBreach will be mentioned in the patch.<br>
&gt; &gt; &gt; Could you please change the THANKS and NEWS.md file to say R=
on Ben<br>
&gt; &gt; &gt; Yizhak@SafeBreach instead of Ron Ben Yizhak?<br>
&gt; &gt; &gt;<br>
&gt; &gt; &gt; Also, when will a CVE be assigned for this vulnerability?<br=
>
&gt; &gt; &gt; Thank you,<br>
&gt; &gt; &gt; Ron Ben Yizhak<br>
&gt; &gt; &gt;<br>
&gt; &gt; &gt; On Sun, Feb 15, 2026 at 7:21=E2=80=AFPM Erik Auerswald &lt;<=
br>
&gt; &gt; <a href=3D"mailto:[email protected]" target=3D"_blank">a=
[email protected]</a>&gt;<br>
&gt; &gt; &gt; wrote:<br>
&gt; &gt; &gt;<br>
&gt; &gt; &gt; &gt; Hi Simon,<br>
&gt; &gt; &gt; &gt;<br>
&gt; &gt; &gt; &gt; On Sun, Feb 15, 2026 at 04:36:56PM +0100, Simon Josefss=
on wrote:<br>
&gt; &gt; &gt; &gt; &gt; Erik Auerswald &lt;<a href=3D"mailto:auerswal@unix=
-ag.uni-kl.de" target=3D"_blank">[email protected]</a>&gt; writes:=
<br>
&gt; &gt; &gt; &gt; &gt;<br>
&gt; &gt; &gt; &gt; &gt; &gt; I plan to commit and push the attached patch =
in a few days to<br>
&gt; &gt; address<br>
&gt; &gt; &gt; &gt; &gt; &gt; this vulnerability, unless there are reasonab=
le objections.<br>
&gt; &gt; &gt; &gt; &gt;<br>
&gt; &gt; &gt; &gt; &gt; Thanks -- I wish we could implement the --accept-e=
nv approach and<br>
&gt; &gt; make<br>
&gt; &gt; &gt; &gt; &gt; the default not set any environment variables at a=
ll, but I don&#39;t<br>
&gt; &gt; have<br>
&gt; &gt; &gt; &gt; &gt; cycles to work on that.=C2=A0 Anyone else?<br>
&gt; &gt; &gt; &gt;<br>
&gt; &gt; &gt; &gt; Me neither.<br>
&gt; &gt; &gt; &gt;<br>
&gt; &gt; &gt; &gt; &gt; Your patch seems to close this vulnerability repor=
t in a most minimal<br>
&gt; &gt; &gt; &gt; &gt; way, so IMHO we should apply it.<br>
&gt; &gt; &gt; &gt;<br>
&gt; &gt; &gt; &gt; I have just applied it.<br>
&gt; &gt; &gt; &gt;<br>
&gt; &gt; &gt; &gt; Cheers,<br>
&gt; &gt; &gt; &gt; Erik<br>
</blockquote></div>

--0000000000001c34b1064b65ad1e--