Executive brief
The Telnet service, used for remote terminal access, contains a long-standing vulnerability that allows remote attackers to gain full administrative (root) control over a system. By sending malicious environment variables during the connection process, an attacker can force the system to load unauthorized software libraries. This can lead to complete system compromise, data theft, and persistent unauthorized access.
Technical details
This vulnerability arises from improper sanitization of environment variables passed via the Telnet NEW_ENVIRON option. A remote, unauthenticated attacker can specify variables such as LD_LIBRARY_PATH, _RLD_PATH, or LIBPATH to influence the dynamic linker when the telnet daemon executes the login process. This allows the injection of arbitrary shared libraries, leading to privilege escalation to root. While many distributions patched this in the late 1990s using blacklists, recent analysis shows that GNU InetUtils remained vulnerable due to insufficient scrubbing (e.g., missing newer variables like CREDENTIALS_DIRECTORY). Modern fixes involve moving from a blacklist to a strict whitelist (e.g., USER, TERM, LANG) and sanitizing values to prevent path traversal.
Affected products
- GNU InetUtils All versions prior to 2026 patches
- NetKit telnetd 0.17 and earlier
Timeline
- 1995-10-13: disclosed: Initial vulnerability reported
- 1999-01-01: advisory: CVE-1999-0073 assigned
- 2026-02-24: other: Discussion of regression and insufficient blacklisting in modern InetUtils versions on oss-security
- 2026-03-08: patched: Proposed whitelist-based patch set submitted for GNU InetUtils