CVE-2013-4342: High severity suse xinetd vulnerability
Created attachment 795808 [details] preliminary patch to set credentials before execve
Description of problem:
If a tcpmux service is enabled, the user and group directives are ignored and the service always runs as root. Verified in the xinetd codebase and affects all active versions of RHEL and Fedora. Without the fix for CVE-2012-0862, previously exposed non-tcpmux services could run as root bypassing their respective user and group restrictions.
Version-Release number of selected component (if applicable): 2.3.15-6
How reproducible: Always
Steps to Reproduce: 1. Enabled tcpmux-server 2. Create a sample tcpmux service
service testcred { id = tcpmux-testcred disable = no user = nobody group = nobody sockettype = stream type = TCPMUXPLUS UNLISTED flags = NAMEINARGS server = /usr/bin/id serverargs = id wait = no }
3. telnet localhost 1 4. type testcred
Actual results: Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. testcred +Go uid=0(root) gid=0(root) groups=0(root)
Expected results: Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. testcred +Go uid=99(nobody) gid=99(nobody) groups=99(nobody)
Additional info:
Other sources
xinetd does not enforce the user and group configuration directives for TCPMUX services, which causes these services to be run as root and makes it easier for remote attackers to gain privileges by leveraging another vulnerability in a service.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4342?
CVE-2013-4342 is rated as medium severity due to potential privilege escalation risks.
How do I fix CVE-2013-4342?
To fix CVE-2013-4342, update to the latest version of Xinetd as per your operating system's security patch.
What software is affected by CVE-2013-4342?
CVE-2013-4342 affects Xinetd and Red Hat Enterprise Linux versions 5 and 6.0.
What are the potential impacts of CVE-2013-4342?
The main impact of CVE-2013-4342 is the potential for unauthorized users to gain elevated privileges.
Is CVE-2013-4342 still a risk in current software versions?
CVE-2013-4342 may still pose a risk if the affected software has not been updated or is running legacy versions.