ANCIENT TELNET BUG HAPPILY HANDS OUT ROOT TO ATTACKERS

Summary from the TLDR InfoSec newsletter

A critical (CVSS 9.8) vulnerability in telnet could allow unauthenticated users to obtain root privileges on systems running InetUtils telnetd. To exploit the vulnerability, an attacker only needs to set their USER environment variable to “-f root” and pass the “-a” or “--login” flag to telnet. Experts recommend updating to the latest version of telnet or, ideally, switching to a more secure protocol such as SSH.