|
Multiple Vendor telnetd Vulnerability
A vulnerability existed in a number of in.telnetd's, that when coupled with dynamic linking introduced a very serious vulnerability. Telnet supports the passing of environment variables from a remote host. On vulnerable systems, an attacker would place a shared object containing code they are sure will be run, for instance, the crypt() function on the system. This could be via ftp, nfs, or any other method for getting a file on the system. They would then set this library to be part of their LD_PRELOAD enviroment variable. Upon telneting into the machine, when telnet exec'd /bin/login to authenticate the user, the system dynamic linker would load the library listed in the preload, which would override the normal library call. This in turn could allow a user to execute code as root. |
|
|
Privacy Statement |
