SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Xinetd Vendors:   Xinetd.org
Xinetd TCPMUX Bug Lets Remote Users Access Restricted Services
SecurityTracker Alert ID:  1027050
SecurityTracker URL:  http://securitytracker.com/id/1027050
CVE Reference:   CVE-2012-0862   (Links to External Site)
Date:  May 9 2012
Impact:   Host/resource access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to 2.3.15
Description:   A vulnerability was reported in Xinetd. A remote user can access restricted services.

If the tcpmux-server service is enabled, a remote user can connect to the tcpmux port to access all enabled services instead of just the configured services.

Thomas Swan of FedEx reported this vulnerability.

Impact:   A remote user can access restricted services.
Solution:   The vendor has issued a fix (2.3.15)

The vendor's advisory is available at:

http://www.xinetd.org/#changes

Vendor URL:  www.xinetd.org/ (Links to External Site)
Cause:   Access control error
Underlying OS:  Linux (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Oct 1 2013 (Red Hat Issues Fix) Xinetd TCPMUX Bug Lets Remote Users Access Restricted Services
Red Hat has issued a fix for Red Hat Enterprise Linux 5.



 Source Message Contents

Subject:  [oss-security] CVE-2012-0862 assignment notification: xinetd enables unintentional services over tcpmux port

Hi,

Thomas Swan of FedEx reported a service disclosure flaw in xinetd.
xinetd allows for services to be configured with the TCPMUX or
TCPMUXPLUS service types, which makes those services available on port
1, as per RFC 1078 [1], if the tcpmux-server service is enabled.  When
the tcpmux-server service is enabled, xinetd would expose _all_ enabled
services via the tcpmux port, instead of just the configured service(s).
This could allow a remote attacker to bypass firewall restrictions and
access services via the tcpmux port.

In order for enabled services handled by xinetd to be exposed via the
tcpmux port, the tcpmux-server service must be enabled (by default it is
disabled).

This has been assigned CVE-2012-0862.

Thomas Swan also provided a patch [2], which has been reviewed by a
former xinetd upstream maintainer and the Red Hat xinetd maintainer
(upstream didn't respond to our contact attempts).

-- References --

[1] Red Hat bug:
https://bugzilla.redhat.com/show_bug.cgi?id=790940

[2] Proposed patch:
https://bugzilla.redhat.com/attachment.cgi?id=583311

Thanks and kind regards,
-- 
Stefan Cornelius / Red Hat Security Response Team
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC