rhsa-2013_0499
Vulnerability from csaf_redhat
Published
2013-02-20 16:17
Modified
2024-11-22 05:43
Summary
Red Hat Security Advisory: xinetd security and bug fix update

Notes

Topic
An updated xinetd package that fixes one security issue and two bugs is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
Details
The xinetd package provides a secure replacement for inetd, the Internet services daemon. xinetd provides access control for all services based on the address of the remote host and/or on time of access, and can prevent denial-of-access attacks. When xinetd services are configured with the "TCPMUX" or "TCPMUXPLUS" type, and the tcpmux-server service is enabled, those services are accessible via port 1. It was found that enabling the tcpmux-server service (it is disabled by default) allowed every xinetd service, including those that are not configured with the "TCPMUX" or "TCPMUXPLUS" type, to be accessible via port 1. This could allow a remote attacker to bypass intended firewall restrictions. (CVE-2012-0862) Red Hat would like to thank Thomas Swan of FedEx for reporting this issue. This update also fixes the following bugs: * Prior to this update, a file descriptor array in the service.c source file was not handled as expected. As a consequence, some of the descriptors remained open when xinetd was under heavy load. Additionally, the system log was filled with a large number of messages that took up a lot of disk space over time. This update modifies the xinetd code to handle the file descriptors correctly and messages no longer fill the system log. (BZ#790036) * Prior to this update, services were disabled permanently when their CPS limit was reached. As a consequence, a failed bind operation could occur when xinetd attempted to restart the service. This update adds additional logic that attempts to restart the service. Now, the service is only disabled if xinetd cannot restart the service after 30 attempts. (BZ#809271) All users of xinetd are advised to upgrade to this updated package, which contains backported patches to correct these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An updated xinetd package that fixes one security issue and two bugs is now\navailable for Red Hat Enterprise Linux 6.\n\nThe Red Hat Security Response Team has rated this update as having low\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The xinetd package provides a secure replacement for inetd, the Internet\nservices daemon. xinetd provides access control for all services based on\nthe address of the remote host and/or on time of access, and can prevent\ndenial-of-access attacks.\n\nWhen xinetd services are configured with the \"TCPMUX\" or \"TCPMUXPLUS\" type,\nand the tcpmux-server service is enabled, those services are accessible via\nport 1. It was found that enabling the tcpmux-server service (it is\ndisabled by default) allowed every xinetd service, including those that are\nnot configured with the \"TCPMUX\" or \"TCPMUXPLUS\" type, to be accessible via\nport 1. This could allow a remote attacker to bypass intended firewall\nrestrictions. (CVE-2012-0862)\n\nRed Hat would like to thank Thomas Swan of FedEx for reporting this issue.\n\nThis update also fixes the following bugs:\n\n* Prior to this update, a file descriptor array in the service.c source\nfile was not handled as expected. As a consequence, some of the descriptors\nremained open when xinetd was under heavy load. Additionally, the system\nlog was filled with a large number of messages that took up a lot of disk\nspace over time. This update modifies the xinetd code to handle the file\ndescriptors correctly and messages no longer fill the system log.\n(BZ#790036)\n\n* Prior to this update, services were disabled permanently when their CPS\nlimit was reached. As a consequence, a failed bind operation could occur\nwhen xinetd attempted to restart the service. This update adds additional\nlogic that attempts to restart the service. Now, the service is only\ndisabled if xinetd cannot restart the service after 30 attempts.\n(BZ#809271)\n\nAll users of xinetd are advised to upgrade to this updated package, which\ncontains backported patches to correct these issues.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2013:0499",
        "url": "https://access.redhat.com/errata/RHSA-2013:0499"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#low",
        "url": "https://access.redhat.com/security/updates/classification/#low"
      },
      {
        "category": "external",
        "summary": "790036",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=790036"
      },
      {
        "category": "external",
        "summary": "790940",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=790940"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0499.json"
      }
    ],
    "title": "Red Hat Security Advisory: xinetd security and bug fix update",
    "tracking": {
      "current_release_date": "2024-11-22T05:43:07+00:00",
      "generator": {
        "date": "2024-11-22T05:43:07+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2013:0499",
      "initial_release_date": "2013-02-20T16:17:00+00:00",
      "revision_history": [
        {
          "date": "2013-02-20T16:17:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2013-02-20T16:18:17+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T05:43:07+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Desktop (v. 6)",
                "product": {
                  "name": "Red Hat Enterprise Linux Desktop (v. 6)",
                  "product_id": "6Client",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:6::client"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux HPC Node (v. 6)",
                "product": {
                  "name": "Red Hat Enterprise Linux HPC Node (v. 6)",
                  "product_id": "6ComputeNode",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:6::computenode"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Server (v. 6)",
                "product": {
                  "name": "Red Hat Enterprise Linux Server (v. 6)",
                  "product_id": "6Server",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:6::server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Workstation (v. 6)",
                "product": {
                  "name": "Red Hat Enterprise Linux Workstation (v. 6)",
                  "product_id": "6Workstation",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:6::workstation"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xinetd-2:2.3.14-38.el6.x86_64",
                "product": {
                  "name": "xinetd-2:2.3.14-38.el6.x86_64",
                  "product_id": "xinetd-2:2.3.14-38.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xinetd@2.3.14-38.el6?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xinetd-debuginfo-2:2.3.14-38.el6.x86_64",
                "product": {
                  "name": "xinetd-debuginfo-2:2.3.14-38.el6.x86_64",
                  "product_id": "xinetd-debuginfo-2:2.3.14-38.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xinetd-debuginfo@2.3.14-38.el6?arch=x86_64\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xinetd-2:2.3.14-38.el6.src",
                "product": {
                  "name": "xinetd-2:2.3.14-38.el6.src",
                  "product_id": "xinetd-2:2.3.14-38.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xinetd@2.3.14-38.el6?arch=src\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xinetd-2:2.3.14-38.el6.i686",
                "product": {
                  "name": "xinetd-2:2.3.14-38.el6.i686",
                  "product_id": "xinetd-2:2.3.14-38.el6.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xinetd@2.3.14-38.el6?arch=i686\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xinetd-debuginfo-2:2.3.14-38.el6.i686",
                "product": {
                  "name": "xinetd-debuginfo-2:2.3.14-38.el6.i686",
                  "product_id": "xinetd-debuginfo-2:2.3.14-38.el6.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xinetd-debuginfo@2.3.14-38.el6?arch=i686\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xinetd-2:2.3.14-38.el6.s390x",
                "product": {
                  "name": "xinetd-2:2.3.14-38.el6.s390x",
                  "product_id": "xinetd-2:2.3.14-38.el6.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xinetd@2.3.14-38.el6?arch=s390x\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xinetd-debuginfo-2:2.3.14-38.el6.s390x",
                "product": {
                  "name": "xinetd-debuginfo-2:2.3.14-38.el6.s390x",
                  "product_id": "xinetd-debuginfo-2:2.3.14-38.el6.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xinetd-debuginfo@2.3.14-38.el6?arch=s390x\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xinetd-2:2.3.14-38.el6.ppc64",
                "product": {
                  "name": "xinetd-2:2.3.14-38.el6.ppc64",
                  "product_id": "xinetd-2:2.3.14-38.el6.ppc64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xinetd@2.3.14-38.el6?arch=ppc64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xinetd-debuginfo-2:2.3.14-38.el6.ppc64",
                "product": {
                  "name": "xinetd-debuginfo-2:2.3.14-38.el6.ppc64",
                  "product_id": "xinetd-debuginfo-2:2.3.14-38.el6.ppc64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xinetd-debuginfo@2.3.14-38.el6?arch=ppc64\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-2:2.3.14-38.el6.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
          "product_id": "6Client:xinetd-2:2.3.14-38.el6.i686"
        },
        "product_reference": "xinetd-2:2.3.14-38.el6.i686",
        "relates_to_product_reference": "6Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-2:2.3.14-38.el6.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
          "product_id": "6Client:xinetd-2:2.3.14-38.el6.ppc64"
        },
        "product_reference": "xinetd-2:2.3.14-38.el6.ppc64",
        "relates_to_product_reference": "6Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-2:2.3.14-38.el6.s390x as a component of Red Hat Enterprise Linux Desktop (v. 6)",
          "product_id": "6Client:xinetd-2:2.3.14-38.el6.s390x"
        },
        "product_reference": "xinetd-2:2.3.14-38.el6.s390x",
        "relates_to_product_reference": "6Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-2:2.3.14-38.el6.src as a component of Red Hat Enterprise Linux Desktop (v. 6)",
          "product_id": "6Client:xinetd-2:2.3.14-38.el6.src"
        },
        "product_reference": "xinetd-2:2.3.14-38.el6.src",
        "relates_to_product_reference": "6Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-2:2.3.14-38.el6.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
          "product_id": "6Client:xinetd-2:2.3.14-38.el6.x86_64"
        },
        "product_reference": "xinetd-2:2.3.14-38.el6.x86_64",
        "relates_to_product_reference": "6Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-debuginfo-2:2.3.14-38.el6.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
          "product_id": "6Client:xinetd-debuginfo-2:2.3.14-38.el6.i686"
        },
        "product_reference": "xinetd-debuginfo-2:2.3.14-38.el6.i686",
        "relates_to_product_reference": "6Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-debuginfo-2:2.3.14-38.el6.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
          "product_id": "6Client:xinetd-debuginfo-2:2.3.14-38.el6.ppc64"
        },
        "product_reference": "xinetd-debuginfo-2:2.3.14-38.el6.ppc64",
        "relates_to_product_reference": "6Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-debuginfo-2:2.3.14-38.el6.s390x as a component of Red Hat Enterprise Linux Desktop (v. 6)",
          "product_id": "6Client:xinetd-debuginfo-2:2.3.14-38.el6.s390x"
        },
        "product_reference": "xinetd-debuginfo-2:2.3.14-38.el6.s390x",
        "relates_to_product_reference": "6Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-debuginfo-2:2.3.14-38.el6.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
          "product_id": "6Client:xinetd-debuginfo-2:2.3.14-38.el6.x86_64"
        },
        "product_reference": "xinetd-debuginfo-2:2.3.14-38.el6.x86_64",
        "relates_to_product_reference": "6Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-2:2.3.14-38.el6.i686 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
          "product_id": "6ComputeNode:xinetd-2:2.3.14-38.el6.i686"
        },
        "product_reference": "xinetd-2:2.3.14-38.el6.i686",
        "relates_to_product_reference": "6ComputeNode"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-2:2.3.14-38.el6.ppc64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
          "product_id": "6ComputeNode:xinetd-2:2.3.14-38.el6.ppc64"
        },
        "product_reference": "xinetd-2:2.3.14-38.el6.ppc64",
        "relates_to_product_reference": "6ComputeNode"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-2:2.3.14-38.el6.s390x as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
          "product_id": "6ComputeNode:xinetd-2:2.3.14-38.el6.s390x"
        },
        "product_reference": "xinetd-2:2.3.14-38.el6.s390x",
        "relates_to_product_reference": "6ComputeNode"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-2:2.3.14-38.el6.src as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
          "product_id": "6ComputeNode:xinetd-2:2.3.14-38.el6.src"
        },
        "product_reference": "xinetd-2:2.3.14-38.el6.src",
        "relates_to_product_reference": "6ComputeNode"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-2:2.3.14-38.el6.x86_64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
          "product_id": "6ComputeNode:xinetd-2:2.3.14-38.el6.x86_64"
        },
        "product_reference": "xinetd-2:2.3.14-38.el6.x86_64",
        "relates_to_product_reference": "6ComputeNode"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-debuginfo-2:2.3.14-38.el6.i686 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
          "product_id": "6ComputeNode:xinetd-debuginfo-2:2.3.14-38.el6.i686"
        },
        "product_reference": "xinetd-debuginfo-2:2.3.14-38.el6.i686",
        "relates_to_product_reference": "6ComputeNode"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-debuginfo-2:2.3.14-38.el6.ppc64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
          "product_id": "6ComputeNode:xinetd-debuginfo-2:2.3.14-38.el6.ppc64"
        },
        "product_reference": "xinetd-debuginfo-2:2.3.14-38.el6.ppc64",
        "relates_to_product_reference": "6ComputeNode"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-debuginfo-2:2.3.14-38.el6.s390x as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
          "product_id": "6ComputeNode:xinetd-debuginfo-2:2.3.14-38.el6.s390x"
        },
        "product_reference": "xinetd-debuginfo-2:2.3.14-38.el6.s390x",
        "relates_to_product_reference": "6ComputeNode"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-debuginfo-2:2.3.14-38.el6.x86_64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
          "product_id": "6ComputeNode:xinetd-debuginfo-2:2.3.14-38.el6.x86_64"
        },
        "product_reference": "xinetd-debuginfo-2:2.3.14-38.el6.x86_64",
        "relates_to_product_reference": "6ComputeNode"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-2:2.3.14-38.el6.i686 as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server:xinetd-2:2.3.14-38.el6.i686"
        },
        "product_reference": "xinetd-2:2.3.14-38.el6.i686",
        "relates_to_product_reference": "6Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-2:2.3.14-38.el6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server:xinetd-2:2.3.14-38.el6.ppc64"
        },
        "product_reference": "xinetd-2:2.3.14-38.el6.ppc64",
        "relates_to_product_reference": "6Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-2:2.3.14-38.el6.s390x as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server:xinetd-2:2.3.14-38.el6.s390x"
        },
        "product_reference": "xinetd-2:2.3.14-38.el6.s390x",
        "relates_to_product_reference": "6Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-2:2.3.14-38.el6.src as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server:xinetd-2:2.3.14-38.el6.src"
        },
        "product_reference": "xinetd-2:2.3.14-38.el6.src",
        "relates_to_product_reference": "6Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-2:2.3.14-38.el6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server:xinetd-2:2.3.14-38.el6.x86_64"
        },
        "product_reference": "xinetd-2:2.3.14-38.el6.x86_64",
        "relates_to_product_reference": "6Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-debuginfo-2:2.3.14-38.el6.i686 as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server:xinetd-debuginfo-2:2.3.14-38.el6.i686"
        },
        "product_reference": "xinetd-debuginfo-2:2.3.14-38.el6.i686",
        "relates_to_product_reference": "6Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-debuginfo-2:2.3.14-38.el6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server:xinetd-debuginfo-2:2.3.14-38.el6.ppc64"
        },
        "product_reference": "xinetd-debuginfo-2:2.3.14-38.el6.ppc64",
        "relates_to_product_reference": "6Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-debuginfo-2:2.3.14-38.el6.s390x as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server:xinetd-debuginfo-2:2.3.14-38.el6.s390x"
        },
        "product_reference": "xinetd-debuginfo-2:2.3.14-38.el6.s390x",
        "relates_to_product_reference": "6Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-debuginfo-2:2.3.14-38.el6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server:xinetd-debuginfo-2:2.3.14-38.el6.x86_64"
        },
        "product_reference": "xinetd-debuginfo-2:2.3.14-38.el6.x86_64",
        "relates_to_product_reference": "6Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-2:2.3.14-38.el6.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation:xinetd-2:2.3.14-38.el6.i686"
        },
        "product_reference": "xinetd-2:2.3.14-38.el6.i686",
        "relates_to_product_reference": "6Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-2:2.3.14-38.el6.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation:xinetd-2:2.3.14-38.el6.ppc64"
        },
        "product_reference": "xinetd-2:2.3.14-38.el6.ppc64",
        "relates_to_product_reference": "6Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-2:2.3.14-38.el6.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation:xinetd-2:2.3.14-38.el6.s390x"
        },
        "product_reference": "xinetd-2:2.3.14-38.el6.s390x",
        "relates_to_product_reference": "6Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-2:2.3.14-38.el6.src as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation:xinetd-2:2.3.14-38.el6.src"
        },
        "product_reference": "xinetd-2:2.3.14-38.el6.src",
        "relates_to_product_reference": "6Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-2:2.3.14-38.el6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation:xinetd-2:2.3.14-38.el6.x86_64"
        },
        "product_reference": "xinetd-2:2.3.14-38.el6.x86_64",
        "relates_to_product_reference": "6Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-debuginfo-2:2.3.14-38.el6.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation:xinetd-debuginfo-2:2.3.14-38.el6.i686"
        },
        "product_reference": "xinetd-debuginfo-2:2.3.14-38.el6.i686",
        "relates_to_product_reference": "6Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-debuginfo-2:2.3.14-38.el6.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation:xinetd-debuginfo-2:2.3.14-38.el6.ppc64"
        },
        "product_reference": "xinetd-debuginfo-2:2.3.14-38.el6.ppc64",
        "relates_to_product_reference": "6Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-debuginfo-2:2.3.14-38.el6.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation:xinetd-debuginfo-2:2.3.14-38.el6.s390x"
        },
        "product_reference": "xinetd-debuginfo-2:2.3.14-38.el6.s390x",
        "relates_to_product_reference": "6Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xinetd-debuginfo-2:2.3.14-38.el6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation:xinetd-debuginfo-2:2.3.14-38.el6.x86_64"
        },
        "product_reference": "xinetd-debuginfo-2:2.3.14-38.el6.x86_64",
        "relates_to_product_reference": "6Workstation"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Thomas Swan"
          ],
          "organization": "FedEx"
        }
      ],
      "cve": "CVE-2012-0862",
      "discovery_date": "2012-02-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "790940"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "builtins.c in Xinetd before 2.3.15 does not check the service type when the tcpmux-server service is enabled, which exposes all enabled services and allows remote attackers to bypass intended access restrictions via a request to tcpmux port 1.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "xinetd: enables unintentional services over tcpmux port",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This flaw has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Client:xinetd-2:2.3.14-38.el6.i686",
          "6Client:xinetd-2:2.3.14-38.el6.ppc64",
          "6Client:xinetd-2:2.3.14-38.el6.s390x",
          "6Client:xinetd-2:2.3.14-38.el6.src",
          "6Client:xinetd-2:2.3.14-38.el6.x86_64",
          "6Client:xinetd-debuginfo-2:2.3.14-38.el6.i686",
          "6Client:xinetd-debuginfo-2:2.3.14-38.el6.ppc64",
          "6Client:xinetd-debuginfo-2:2.3.14-38.el6.s390x",
          "6Client:xinetd-debuginfo-2:2.3.14-38.el6.x86_64",
          "6ComputeNode:xinetd-2:2.3.14-38.el6.i686",
          "6ComputeNode:xinetd-2:2.3.14-38.el6.ppc64",
          "6ComputeNode:xinetd-2:2.3.14-38.el6.s390x",
          "6ComputeNode:xinetd-2:2.3.14-38.el6.src",
          "6ComputeNode:xinetd-2:2.3.14-38.el6.x86_64",
          "6ComputeNode:xinetd-debuginfo-2:2.3.14-38.el6.i686",
          "6ComputeNode:xinetd-debuginfo-2:2.3.14-38.el6.ppc64",
          "6ComputeNode:xinetd-debuginfo-2:2.3.14-38.el6.s390x",
          "6ComputeNode:xinetd-debuginfo-2:2.3.14-38.el6.x86_64",
          "6Server:xinetd-2:2.3.14-38.el6.i686",
          "6Server:xinetd-2:2.3.14-38.el6.ppc64",
          "6Server:xinetd-2:2.3.14-38.el6.s390x",
          "6Server:xinetd-2:2.3.14-38.el6.src",
          "6Server:xinetd-2:2.3.14-38.el6.x86_64",
          "6Server:xinetd-debuginfo-2:2.3.14-38.el6.i686",
          "6Server:xinetd-debuginfo-2:2.3.14-38.el6.ppc64",
          "6Server:xinetd-debuginfo-2:2.3.14-38.el6.s390x",
          "6Server:xinetd-debuginfo-2:2.3.14-38.el6.x86_64",
          "6Workstation:xinetd-2:2.3.14-38.el6.i686",
          "6Workstation:xinetd-2:2.3.14-38.el6.ppc64",
          "6Workstation:xinetd-2:2.3.14-38.el6.s390x",
          "6Workstation:xinetd-2:2.3.14-38.el6.src",
          "6Workstation:xinetd-2:2.3.14-38.el6.x86_64",
          "6Workstation:xinetd-debuginfo-2:2.3.14-38.el6.i686",
          "6Workstation:xinetd-debuginfo-2:2.3.14-38.el6.ppc64",
          "6Workstation:xinetd-debuginfo-2:2.3.14-38.el6.s390x",
          "6Workstation:xinetd-debuginfo-2:2.3.14-38.el6.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-0862"
        },
        {
          "category": "external",
          "summary": "RHBZ#790940",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=790940"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-0862",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-0862"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-0862",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0862"
        }
      ],
      "release_date": "2012-05-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-02-20T16:17:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "6Client:xinetd-2:2.3.14-38.el6.i686",
            "6Client:xinetd-2:2.3.14-38.el6.ppc64",
            "6Client:xinetd-2:2.3.14-38.el6.s390x",
            "6Client:xinetd-2:2.3.14-38.el6.src",
            "6Client:xinetd-2:2.3.14-38.el6.x86_64",
            "6Client:xinetd-debuginfo-2:2.3.14-38.el6.i686",
            "6Client:xinetd-debuginfo-2:2.3.14-38.el6.ppc64",
            "6Client:xinetd-debuginfo-2:2.3.14-38.el6.s390x",
            "6Client:xinetd-debuginfo-2:2.3.14-38.el6.x86_64",
            "6ComputeNode:xinetd-2:2.3.14-38.el6.i686",
            "6ComputeNode:xinetd-2:2.3.14-38.el6.ppc64",
            "6ComputeNode:xinetd-2:2.3.14-38.el6.s390x",
            "6ComputeNode:xinetd-2:2.3.14-38.el6.src",
            "6ComputeNode:xinetd-2:2.3.14-38.el6.x86_64",
            "6ComputeNode:xinetd-debuginfo-2:2.3.14-38.el6.i686",
            "6ComputeNode:xinetd-debuginfo-2:2.3.14-38.el6.ppc64",
            "6ComputeNode:xinetd-debuginfo-2:2.3.14-38.el6.s390x",
            "6ComputeNode:xinetd-debuginfo-2:2.3.14-38.el6.x86_64",
            "6Server:xinetd-2:2.3.14-38.el6.i686",
            "6Server:xinetd-2:2.3.14-38.el6.ppc64",
            "6Server:xinetd-2:2.3.14-38.el6.s390x",
            "6Server:xinetd-2:2.3.14-38.el6.src",
            "6Server:xinetd-2:2.3.14-38.el6.x86_64",
            "6Server:xinetd-debuginfo-2:2.3.14-38.el6.i686",
            "6Server:xinetd-debuginfo-2:2.3.14-38.el6.ppc64",
            "6Server:xinetd-debuginfo-2:2.3.14-38.el6.s390x",
            "6Server:xinetd-debuginfo-2:2.3.14-38.el6.x86_64",
            "6Workstation:xinetd-2:2.3.14-38.el6.i686",
            "6Workstation:xinetd-2:2.3.14-38.el6.ppc64",
            "6Workstation:xinetd-2:2.3.14-38.el6.s390x",
            "6Workstation:xinetd-2:2.3.14-38.el6.src",
            "6Workstation:xinetd-2:2.3.14-38.el6.x86_64",
            "6Workstation:xinetd-debuginfo-2:2.3.14-38.el6.i686",
            "6Workstation:xinetd-debuginfo-2:2.3.14-38.el6.ppc64",
            "6Workstation:xinetd-debuginfo-2:2.3.14-38.el6.s390x",
            "6Workstation:xinetd-debuginfo-2:2.3.14-38.el6.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0499"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 2.6,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "6Client:xinetd-2:2.3.14-38.el6.i686",
            "6Client:xinetd-2:2.3.14-38.el6.ppc64",
            "6Client:xinetd-2:2.3.14-38.el6.s390x",
            "6Client:xinetd-2:2.3.14-38.el6.src",
            "6Client:xinetd-2:2.3.14-38.el6.x86_64",
            "6Client:xinetd-debuginfo-2:2.3.14-38.el6.i686",
            "6Client:xinetd-debuginfo-2:2.3.14-38.el6.ppc64",
            "6Client:xinetd-debuginfo-2:2.3.14-38.el6.s390x",
            "6Client:xinetd-debuginfo-2:2.3.14-38.el6.x86_64",
            "6ComputeNode:xinetd-2:2.3.14-38.el6.i686",
            "6ComputeNode:xinetd-2:2.3.14-38.el6.ppc64",
            "6ComputeNode:xinetd-2:2.3.14-38.el6.s390x",
            "6ComputeNode:xinetd-2:2.3.14-38.el6.src",
            "6ComputeNode:xinetd-2:2.3.14-38.el6.x86_64",
            "6ComputeNode:xinetd-debuginfo-2:2.3.14-38.el6.i686",
            "6ComputeNode:xinetd-debuginfo-2:2.3.14-38.el6.ppc64",
            "6ComputeNode:xinetd-debuginfo-2:2.3.14-38.el6.s390x",
            "6ComputeNode:xinetd-debuginfo-2:2.3.14-38.el6.x86_64",
            "6Server:xinetd-2:2.3.14-38.el6.i686",
            "6Server:xinetd-2:2.3.14-38.el6.ppc64",
            "6Server:xinetd-2:2.3.14-38.el6.s390x",
            "6Server:xinetd-2:2.3.14-38.el6.src",
            "6Server:xinetd-2:2.3.14-38.el6.x86_64",
            "6Server:xinetd-debuginfo-2:2.3.14-38.el6.i686",
            "6Server:xinetd-debuginfo-2:2.3.14-38.el6.ppc64",
            "6Server:xinetd-debuginfo-2:2.3.14-38.el6.s390x",
            "6Server:xinetd-debuginfo-2:2.3.14-38.el6.x86_64",
            "6Workstation:xinetd-2:2.3.14-38.el6.i686",
            "6Workstation:xinetd-2:2.3.14-38.el6.ppc64",
            "6Workstation:xinetd-2:2.3.14-38.el6.s390x",
            "6Workstation:xinetd-2:2.3.14-38.el6.src",
            "6Workstation:xinetd-2:2.3.14-38.el6.x86_64",
            "6Workstation:xinetd-debuginfo-2:2.3.14-38.el6.i686",
            "6Workstation:xinetd-debuginfo-2:2.3.14-38.el6.ppc64",
            "6Workstation:xinetd-debuginfo-2:2.3.14-38.el6.s390x",
            "6Workstation:xinetd-debuginfo-2:2.3.14-38.el6.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "xinetd: enables unintentional services over tcpmux port"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.