CVE-2013-4342
First published: Tue Sep 10 2013(Updated: )
Created <span class="bz_obsolete"><a href="attachment.cgi?id=795808&action=diff" name="attach_795808" title="preliminary patch to set credentials before execve">attachment 795808</a> <a href="attachment.cgi?id=795808&action=edit" title="preliminary patch to set credentials before execve">[details]</a></span> preliminary patch to set credentials before execve Description of problem: If a tcpmux service is enabled, the user and group directives are ignored and the service always runs as root. Verified in the xinetd codebase and affects all active versions of RHEL and Fedora. Without the fix for <a href="https://access.redhat.com/security/cve/CVE-2012-0862">CVE-2012-0862</a>, previously exposed non-tcpmux services could run as root bypassing their respective user and group restrictions. Version-Release number of selected component (if applicable): 2.3.15-6 How reproducible: Always Steps to Reproduce: 1. Enabled tcpmux-server 2. Create a sample tcpmux service service testcred { id = tcpmux-testcred disable = no user = nobody group = nobody socket_type = stream type = TCPMUXPLUS UNLISTED flags = NAMEINARGS server = /usr/bin/id server_args = id wait = no } 3. telnet localhost 1 4. type testcred Actual results: Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. testcred +Go uid=0(root) gid=0(root) groups=0(root) Expected results: Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. testcred +Go uid=99(nobody) gid=99(nobody) groups=99(nobody) Additional info:
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Xinetd Xinetd | ||
| Redhat Enterprise Linux | =5 | |
| Redhat Enterprise Linux | =6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=795808&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=795808&action=edit
- https://access.redhat.com/security/cve/CVE-2012-0862
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=324678
- https://access.redhat.com/security/cve/CVE-2013-4342
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=799732&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=799732&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1006100#c9
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1006100#c1
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1014897
- https://rhn.redhat.com/errata/RHSA-2013-1409.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1006100
- http://rhn.redhat.com/errata/RHSA-2013-1409.html
- https://github.com/xinetd-org/xinetd/pull/10
- https://security.gentoo.org/glsa/201611-06
- collector/nvd-index
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/references
- agent/remedy
- agent/author
- agent/event
- agent/type
- agent/description
- agent/tags
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2013-4342
- vendor/xinetd
- canonical/xinetd xinetd
- vendor/redhat
- canonical/redhat enterprise linux
- version/redhat enterprise linux/5
- version/redhat enterprise linux/6.0