DREAM安全研究团队发现了编号为CVE-2026-32746的严重预认证缓冲区溢出漏洞，该漏洞存在于GNU inetutils Telnetd中已有32年之久 1。这个缺陷最早可追溯到1994年，位于LINEMODE SLC（Set Linemode Characters）协商处理器内，允许攻击者破坏约400字节的邻接变量 1。该漏洞是一个无边界检查的BSS基缓冲区溢出漏洞，理论上可被利用 1。
受影响范围广泛，包括inetutils-telnetd、Ubuntu、Debian、FreeBSD、NetBSD、Citrix NetScaler、Apple Mac Tahoe、Haiku和TrueNAS Core等至少12种系统 1。然而，实际利用该漏洞面临多重制约：数据编码限制、子协商包大小上限（0x200字节）以及不同系统编译导致的内存布局差异均会影响攻击可行性 1。
目前的补丁情况不容乐观 1。inetutils 2.7版本仍然易受攻击，用户需要从git仓库克隆修复提交版本才能获得保护 1。在Debian系统中，只有sid和forky分支包含了相关修复 1。研究人员已发布了检测方法，通过发送异常值来识别易受攻击的服务器是否会在缓冲区外存储数据 1。
Security researchers from the DREAM research team have identified CVE-2026-32746, a pre-authentication buffer overflow vulnerability in GNU inetutils Telnetd that has remained undetected for 32 years since its introduction in 1994.1 The flaw resides in the LINEMODE SLC (Set Linemode Characters) negotiation handler and permits attackers to corrupt approximately 400 bytes of adjacent variables.1
The vulnerability affects at least 12 systems and distributions, including inetutils-telnetd, Ubuntu, Debian, FreeBSD, NetBSD, Citrix NetScaler, Apple Mac Tahoe, Haiku, and TrueNAS Core.1 While theoretically exploitable, practical exploitation is constrained by multiple factors: data encoding limitations, sub-negotiation packet size restrictions of 0x200 bytes, and memory layout variations resulting from different system compilation configurations.1 Researchers developed a detection method by sending anomalous values to identify whether vulnerable servers store data beyond buffer boundaries.1
Patching remains incomplete across affected platforms.1 GNU inetutils version 2.7 continues to be vulnerable, requiring users to build from a fixed commit version cloned directly from the project's repository, while only Debian's sid and forky branches currently include the correction.1 The discovery parallels CVE-2005-0469, a similar Telnet client vulnerability identified in 2005.1
评论
还没有评论，欢迎留下第一条。