CVE-2012-0862: Input Validation
builtins.c in Xinetd before 2.3.15 does not check the service type when the tcpmux-server service is enabled, which exposes all enabled services and allows remote attackers to bypass intended access restrictions via a request to tcpmux port 1.
Other sources
Thomas Swan reported a service disclosure flaw in xinetd. xinetd allows for services to be configured with the TCPMUX or TCPMUXPLUS service types, which makes those services available on port 1, as per RFC 1078 [1], if the tcpmux-server service is enabled. When the tcpmux-server service is enabled, xinetd would expose all enabled services via the tcpmux port, instead of just the configured service(s). This could allow a remote attacker to bypass firewall restrictions and access services via the tcpmux port.
In order for enabled services handled by xinetd to be exposed via the tcpmux port, the tcpmux-server service must be enabled (by default it is disabled).
The tcpmux-server should only ever expose services with the 'type = TCPMUX' or 'type = TCPMUXPLUS' configuration options set.
To reproduce:
- enable tcpmux-server - restart xinetd - telnet localhost 1 - type service name of a running service (e.g. cvspserver)
The service will be launched and respond on the port:
telnet localhost 1 Trying 127.0.0.1... Connected to localhost.localdomain (127.0.0.1). Escape character is '^]'. cvspserver
cvs [pserver aborted]: bad auth protocol start:
There is no upstream fix for this as of yet.
[1] http://tools.ietf.org/html/rfc1078
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-0862?
CVE-2012-0862 is classified as a medium severity vulnerability that allows remote attackers to disclose services.
How do I fix CVE-2012-0862?
To fix CVE-2012-0862, upgrade to xinetd version 2.3.15 or later.
What systems are affected by CVE-2012-0862?
CVE-2012-0862 affects xinetd versions prior to 2.3.15.
What type of vulnerability is CVE-2012-0862?
CVE-2012-0862 is a service disclosure vulnerability related to improper checks in the tcpmux-server service.
Can CVE-2012-0862 allow unauthorized access?
Yes, CVE-2012-0862 can allow unauthorized remote attackers to bypass access restrictions.