A 32-year-old bug walks into a Telnet server

A security research firm unearthed a 32-year-old pre-authentication remote code execution bug in GNU inetutils Telnetd, CVE-2026-32746, stemming from a buffer overflow in its LINEMODE SLC negotiation. The extensive technical write-up details the bug's ancient origins, widespread impact, and the nuanced, often difficult path to practical exploitation, especially on modern 64-bit systems. Hacker News is captivated by the historical aspect of lingering vulnerabilities in critical but often forgotten protocols, the depth of the technical analysis, and the ensuing debate over the etiquette of vulnerability disclosures and open-source maintenance.

Score

Comments

Highest Rank

on Front Page

First Seen

Sep 17, 3:00 AM

Last Seen

Sep 17, 10:00 AM

Rank Over Time

The Lowdown

Security researchers at WatchTowr Labs have uncovered CVE-2026-32746, a pre-authentication remote code execution (RCE) vulnerability in GNU inetutils Telnetd that has lain dormant since 1994. This 32-year-old bug, originating from a time when RISC was already well-established and Hackers graced the silver screen, highlights the persistent risks of ancient code in foundational network services.

The Vulnerability's Core: The bug is a BSS-based buffer overflow within the LINEMODE SLC (Set Linemode Characters) negotiation handler, allowing an attacker to corrupt approximately 400 bytes of adjacent global variables. It shares a striking resemblance to CVE-2005-0469, a client-side version of the same flaw fixed two decades prior.
Widespread Impact: While officially in GNU inetutils, numerous operating systems and applications (including major Linux distributions, FreeBSD, NetBSD, Citrix NetScaler, Apple, Haiku, and TrueNAS Core) have incorporated the vulnerable code through forks and copying over the years.
Telnet's Undying Presence: Despite its inherent insecurity (plaintext communication) and SSH being the modern standard, Telnet persists on production systems, especially legacy industrial control machines or embedded devices where upgrading is impractical or impossible, making this vulnerability relevant.
Exploitation Hurdles: Achieving practical RCE is complex. Attackers face restrictions on data content (triplet format, byte modifications, 0xFF byte doubling), tight packet size limits, and the compiler-dependent placement of global variables. Researchers demonstrated arbitrary free primitives and pointer leaks on 32-bit Debian but did not achieve full RCE across all tested systems.
Detection Strategy: A unique detection method was developed that leverages the server's silent dropping of overflow data. By sending a carefully crafted overflow and observing the server's response, one can infer vulnerability without crashing the service.
Patching Purgatory: As of the article's publication, the GNU inetutils project had not released a new version containing the fix (requiring users to build from a specific Git commit), and most Linux distributions were slow to ship updated packages.

The discovery underscores the difficulty in eradicating deeply embedded vulnerabilities in widely forked, ancient codebases. While crafting a reliable, universal exploit is challenging, the sheer breadth of affected systems means specific, high-value targets running legacy Telnet services remain at risk from sufficiently motivated attackers.

The Gossip

Maintainer's Miffed Monologue

The maintainer who patched the bug directly challenged the article's "shamefully" remark regarding the lack of an official `inetutils` release, clarifying that the fix was promptly distributed via mailing lists and oss-security, which is the standard procedure for distributions. They expressed frustration with perceived entitlement from security researchers and the article's sensationalism, noting the volunteer nature of their work and the lack of incentive for new releases. This sparked debate about journalistic integrity in security write-ups.

Prolix Prose & Pedantic Points

Several commenters criticized the article for its excessive length and perceived over-elaboration of technical details, arguing that the core issue was a simple missing bounds check. Some attributed this trend of lengthy, detailed articles to generative AI, suggesting it makes for a less concise and often boring read. Others felt the storytelling aspect overshadowed the technical clarity.

Historical Hiccups & Hyper-Specific Hairsplitting

Readers pointed out minor inaccuracies and nitpicks within the article. Chief among these was the claim that "RISC was still a distant dream" in 1994, which was promptly refuted as RISC architectures were well-established by then. Other comments corrected the phrasing around "in-band signaling" and suggested crediting xkcd for any derivative imagery.