Re: Telnetd Vulnerability Report
Ron Ben Yizhak <[email protected]> Sun, 22 Feb 2026 10:45:18 +0200
| Newsgroups | gmane.comp.gnu.inetutils.bugs |
|---|---|
| Message-ID | <CAB1hGqRGgVz_+fhodhE6bU2UqO6FvE2booaV42bXeT-K3dqn_w@mail.gmail.com> |
--0000000000001c34b1064b65ad1e Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi, Great! Thank you for making this change. What about the CVE? Best regards, Ron On Thu, Feb 19, 2026 at 9:28=E2=80=AFPM Erik Auerswald <[email protected]= i-kl.de> wrote: > Hi, > > I've just pushed the attribution change. > > Cheers, > Erik > > > On Wed, Feb 18, 2026 at 03:41:00PM +0200, Ron Ben Yizhak wrote: > > Hi, > > > > That is perfect. Thank you! > > > > On Wed, Feb 18, 2026 at 3:21=E2=80=AFPM Erik Auerswald < > [email protected]> > > wrote: > > > > > Hi, > > > > > > I think it would be fine to adjust the attribution, would something > like > > > the following be OK? > > > > > > ----------------8<---------------- > > > diff --git a/NEWS.md b/NEWS.md > > > index f5172a71..2d575efa 100644 > > > --- a/NEWS.md > > > +++ b/NEWS.md > > > @@ -8,7 +8,7 @@ improvements and security advisory by Simon Josefsson= . > > > > > > ** Prevent privilege escalation via telnetd abusing systemd service > > > credentials support added to the login(1) implementation of util-lin= ux > > > -in release 2.40. Reported by Ron Ben Yizhak in > > > +in release 2.40. Reported by Ron Ben Yizhak@SafeBreach in > > > < > https://lists.gnu.org/archive/html/bug-inetutils/2026-02/msg00000.html>. > > > > > > ** telnet: Drop everything related to TN3270. > > > diff --git a/THANKS b/THANKS > > > index ef5f6063..f6e725f1 100644 > > > --- a/THANKS > > > +++ b/THANKS > > > @@ -10,7 +10,7 @@ In particular: > > > Nathan Neulinger (tftpd) > > > Thomas Bushnell (sockaddr sin_len field) > > > Kyu Neushwaistein (reported remote root exploit in telnetd) > > > - Ron Ben Yizhak (reported privilege escalation via telnetd) > > > + Ron Ben Yizhak@SafeBreach (reported privilege escalation via > telnetd) > > > > > > Please see version control logs and ChangeLog.? for full credits. > > > > > > ---------------->8---------------- > > > > > > Any objections? > > > > > > Cheers, > > > Erik > > > > > > > > > On Mon, Feb 16, 2026 at 02:03:01PM +0200, Ron Ben Yizhak wrote: > > > > Hi, > > > > > > > > Thank you for handling my report and fixing the vulnerability. As > this > > > > finding was done as part of my job at SafeBreach, it is very > important > > > for > > > > us that SafeBreach will be mentioned in the patch. > > > > Could you please change the THANKS and NEWS.md file to say Ron Ben > > > > Yizhak@SafeBreach instead of Ron Ben Yizhak? > > > > > > > > Also, when will a CVE be assigned for this vulnerability? > > > > Thank you, > > > > Ron Ben Yizhak > > > > > > > > On Sun, Feb 15, 2026 at 7:21=E2=80=AFPM Erik Auerswald < > > > [email protected]> > > > > wrote: > > > > > > > > > Hi Simon, > > > > > > > > > > On Sun, Feb 15, 2026 at 04:36:56PM +0100, Simon Josefsson wrote: > > > > > > Erik Auerswald <[email protected]> writes: > > > > > > > > > > > > > I plan to commit and push the attached patch in a few days to > > > address > > > > > > > this vulnerability, unless there are reasonable objections. > > > > > > > > > > > > Thanks -- I wish we could implement the --accept-env approach a= nd > > > make > > > > > > the default not set any environment variables at all, but I don= 't > > > have > > > > > > cycles to work on that. Anyone else? > > > > > > > > > > Me neither. > > > > > > > > > > > Your patch seems to close this vulnerability report in a most > minimal > > > > > > way, so IMHO we should apply it. > > > > > > > > > > I have just applied it. > > > > > > > > > > Cheers, > > > > > Erik > --0000000000001c34b1064b65ad1e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Hi,<br><br>Great! Thank you for making this change.<div>Wh= at about the CVE?<br><br>Best regards,</div><div>Ron</div></div><br><div cl= ass=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_a= ttr">On Thu, Feb 19, 2026 at 9:28=E2=80=AFPM Erik Auerswald <<a href=3D"= mailto:[email protected]">[email protected]</a>> wrote= :<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.= 8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi,<br> <br> I've just pushed the attribution change.<br> <br> Cheers,<br> Erik<br> <br> <br> On Wed, Feb 18, 2026 at 03:41:00PM +0200, Ron Ben Yizhak wrote:<br> > Hi,<br> > <br> > That is perfect. Thank you!<br> > <br> > On Wed, Feb 18, 2026 at 3:21=E2=80=AFPM Erik Auerswald <<a href=3D"= mailto:[email protected]" target=3D"_blank">[email protected]= l.de</a>><br> > wrote:<br> > <br> > > Hi,<br> > ><br> > > I think it would be fine to adjust the attribution, would somethi= ng like<br> > > the following be OK?<br> > ><br> > > ----------------8<----------------<br> > > diff --git a/NEWS.md b/NEWS.md<br> > > index f5172a71..2d575efa 100644<br> > > --- a/NEWS.md<br> > > +++ b/NEWS.md<br> > > @@ -8,7 +8,7 @@ improvements and security advisory by Simon Josef= sson.<br> > ><br> > >=C2=A0 ** Prevent privilege escalation via telnetd abusing systemd= service<br> > >=C2=A0 credentials support added to the login(1) implementation of= util-linux<br> > > -in release 2.40.=C2=A0 Reported by Ron Ben Yizhak in<br> > > +in release 2.40.=C2=A0 Reported by Ron Ben Yizhak@SafeBreach in<= br> > >=C2=A0 <<a href=3D"https://lists.gnu.org/archive/html/bug-inetu= tils/2026-02/msg00000.html" rel=3D"noreferrer" target=3D"_blank">https://li= sts.gnu.org/archive/html/bug-inetutils/2026-02/msg00000.html</a>>.<br> > ><br> > >=C2=A0 ** telnet: Drop everything related to TN3270.<br> > > diff --git a/THANKS b/THANKS<br> > > index ef5f6063..f6e725f1 100644<br> > > --- a/THANKS<br> > > +++ b/THANKS<br> > > @@ -10,7 +10,7 @@ In particular:<br> > >=C2=A0 =C2=A0 Nathan Neulinger=C2=A0 =C2=A0 =C2=A0 =C2=A0(tftpd)<b= r> > >=C2=A0 =C2=A0 Thomas Bushnell=C2=A0 =C2=A0 =C2=A0 =C2=A0 (sockaddr= sin_len field)<br> > >=C2=A0 =C2=A0 Kyu Neushwaistein=C2=A0 =C2=A0 =C2=A0 (reported remo= te root exploit in telnetd)<br> > > -=C2=A0 Ron Ben Yizhak=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0(reported= privilege escalation via telnetd)<br> > > +=C2=A0 Ron Ben Yizhak@SafeBreach (reported privilege escalation = via telnetd)<br> > ><br> > >=C2=A0 Please see version control logs and ChangeLog.? for full cr= edits.<br> > ><br> > > ---------------->8----------------<br> > ><br> > > Any objections?<br> > ><br> > > Cheers,<br> > > Erik<br> > ><br> > ><br> > > On Mon, Feb 16, 2026 at 02:03:01PM +0200, Ron Ben Yizhak wrote:<b= r> > > > Hi,<br> > > ><br> > > > Thank you for handling my report and fixing the vulnerabilit= y. As this<br> > > > finding was done as part of my job at SafeBreach, it is very= important<br> > > for<br> > > > us that SafeBreach will be mentioned in the patch.<br> > > > Could you please change the THANKS and NEWS.md file to say R= on Ben<br> > > > Yizhak@SafeBreach instead of Ron Ben Yizhak?<br> > > ><br> > > > Also, when will a CVE be assigned for this vulnerability?<br= > > > > Thank you,<br> > > > Ron Ben Yizhak<br> > > ><br> > > > On Sun, Feb 15, 2026 at 7:21=E2=80=AFPM Erik Auerswald <<= br> > > <a href=3D"mailto:[email protected]" target=3D"_blank">a= [email protected]</a>><br> > > > wrote:<br> > > ><br> > > > > Hi Simon,<br> > > > ><br> > > > > On Sun, Feb 15, 2026 at 04:36:56PM +0100, Simon Josefss= on wrote:<br> > > > > > Erik Auerswald <<a href=3D"mailto:auerswal@unix= -ag.uni-kl.de" target=3D"_blank">[email protected]</a>> writes:= <br> > > > > ><br> > > > > > > I plan to commit and push the attached patch = in a few days to<br> > > address<br> > > > > > > this vulnerability, unless there are reasonab= le objections.<br> > > > > ><br> > > > > > Thanks -- I wish we could implement the --accept-e= nv approach and<br> > > make<br> > > > > > the default not set any environment variables at a= ll, but I don't<br> > > have<br> > > > > > cycles to work on that.=C2=A0 Anyone else?<br> > > > ><br> > > > > Me neither.<br> > > > ><br> > > > > > Your patch seems to close this vulnerability repor= t in a most minimal<br> > > > > > way, so IMHO we should apply it.<br> > > > ><br> > > > > I have just applied it.<br> > > > ><br> > > > > Cheers,<br> > > > > Erik<br> </blockquote></div> --0000000000001c34b1064b65ad1e--