GNU InetUtils Vulnerability Exploited via “-f root” to Achieve Full System Control

A critical authentication bypass vulnerability has been identified in GNU InetUtils' telnetd server. This vulnerability allows remote attackers to gain root access without credentials due to improper parameter sanitization.

The affected versions, from 1.9.3 through 2.7, contain a high-severity vulnerability that allows unauthenticated remote attackers to achieve full system compromise.

The vulnerability arises from insufficient input validation of the USER environment variable, which is passed unsanitized by telnetd to the login program running with root privileges. An attacker can exploit this by crafting a specially formatted USER environment variable containing "-f root" and sending it via the telnet client's -a or --login parameter.

Upon receiving this input, telnetd passes the string directly to the login utility, interpreting "-f" as a flag to bypass authentication, thus granting immediate root access without credentials.

The vulnerability exists in the variable expansion logic within telnetd/utility.c, specifically in the _var_short_name() function. The code blindly expands the %U parameter (corresponding to the USER environment variable) without sanitization.

The login command template uses the format "PATH_LOGIN -p -h %h %?u{-f %u}{%U}", passing the user input directly to login with the -f flag. This parameter, designed to bypass authentication, is intended for systems that have already verified user identity.

Exploitation requires minimal setup. An attacker can execute:

This command results in an immediate root shell without password entry. The vulnerability was introduced on March 19, 2015, via commit fa3245ac in the inetutils repository and was included in the v1.9.3 release on May 12, 2015. All subsequent versions through 2.7 remain vulnerable unless patched.

The GNU InetUtils development team recommends disabling telnetd entirely, as modern systems should use SSH instead. Organizations currently running telnetd should immediately apply patches from commits fd702c02 and ccba9f748, which implement comprehensive variable sanitization to prevent similar attack vectors.

Network administrators should restrict telnet port access to trusted clients only and migrate services to SSH as the primary remote access mechanism. The development team also suggests implementing custom login tools that explicitly reject the "-f" parameter.

Based on reporting by GBHackers.