PT-2001-1073 · Xinetd · Xinetd

Published 2001-06-04 · Updated 2008-09-10 · CVE-2001-1322

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions xinetd versions 2.1.8 and earlier

Description The issue concerns multiple vulnerabilities in the xinetd package, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. A key aspect of this issue is that xinetd runs with a default umask of 0, potentially allowing local users to read or modify files created by applications running under xinetd that do not set their own safe umask.

Recommendations For xinetd versions 2.1.8 and earlier, consider setting a safe umask for applications running under xinetd to prevent unauthorized access to files. As a temporary workaround, restrict access to sensitive files and directories that may be affected by the default umask setting until a patch or update is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

BDU:2015-08245

CVE-2001-1322

Affected Products

Xinetd

References · 11

• http://linux-mandrake.com/en/security/2001/MDKSA-2001-055.php3 · Vendor Advisory
• http://debian.org/security/2001/dsa-063 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08245 · Security Note
• http://redhat.com/support/errata/RHSA-2001-075.html · Vendor Advisory
• http://linuxsecurity.com/advisories/other_advisory-1469.html · Vendor Advisory
• http://download.immunix.org/ImmunixOS/7.0/updates/IMNX-2001-70-024-01 · Vendor Advisory
• http://iss.net/security_center/static/6657.php · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000404 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-1322 · Security Note
• https://rhn.redhat.com/errata/RHSA-2001-075.html · Note
• http://securityfocus.com/bid/2826 · Note