A 32-Year-Old Bug Walks into a Telnet Server
a day ago
- A 32-year-old pre-authentication RCE vulnerability in GNU inetutils Telnetd (CVE-2026-32746) allows a BSS-based buffer overflow of about 400 bytes.
- The vulnerability resides in the LINEMODE option and the SLC (Set Linemode Characters) function, which lacks bounds checking.
- Despite its age, Telnet remains in use on production systems, often for legacy or vendor-specific reasons, making the vulnerability's impact broad.
- Exploitation is challenging due to data limitations (triplets, size of 0x200 bytes) and compiler-dependent memory layouts.
- On 32-bit x86 systems, successful exploitation can lead to arbitrary free and potentially RCE, but on 64-bit systems, exploitation is significantly more difficult.
- A detection technique involves sending overflow data and checking if the server echoes back unusual values, which indicates vulnerability.
- The inetutils project has not yet released an official fixed version; only some Debian tracks (sid/forky) have fixes as of writing.
- The vulnerability has been silently present since 1994, with many forks and copies of the code in various products.