CVE-2009-0641

An attacker connects to the telnet daemon and uses the TELNET protocol's environment option to set `LD_PRELOAD` (or similar `LD_*` variables) to point to a malicious shared library already present on the target filesystem [ref_id=2]. Because telnetd's scrubbing is broken, the variable is passed to `/bin/login`, which runs as root and loads the attacker-controlled library, executing arbitrary code with root privileges [ref_id=1][ref_id=2]. Remote exploitation requires a secondary file-upload vector (e.g., anonymous FTP) to place the library on the victim system [ref_id=2].

The vulnerability resides in `sys_term.c` within the telnetd component of FreeBSD 7.x [ref_id=1]. The environment-scrubbing logic in that file became ineffective after changes to FreeBSD's environment-handling code, allowing dangerous environment variables to pass through to `/bin/login` [ref_id=1].

The advisory directs administrators to patch `sys_term.c` in the telnetd source tree and rebuild both `lib/libtelnet` and `libexec/telnetd` [ref_id=1]. The patch restores effective scrubbing of dangerous environment variables (such as `LD_PRELOAD`) so that they are removed before `/bin/login` is executed, closing the code-execution vector [ref_id=1]. No workaround is available; systems not running telnetd are not vulnerable [ref_id=1].

Compile a malicious shared library using the provided C code and gcc commands, then copy it to a known location on the target (e.g., `/tmp/libno_ex.so.1.0`). Connect via telnet, disable SRA authentication, define the `LD_PRELOAD` environment variable pointing to the library, and open the target host. Upon successful login, the library's `_init()` function executes and spawns a root shell [ref_id=2].