PT-2003-1027 · Rinetd · Rinetd

Sam Hocevar · Published 2003-04-26 · Updated 2016-10-18 · CVE-2003-0212

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions rinetd versions prior to 0.62

Description The issue is related to the handleAccept function in rinetd, which does not properly resize the connection list when it becomes full and sets an array index incorrectly. This allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large number of connections. Additionally, there are multiple vulnerabilities in the rinetd package that can lead to breaches of confidentiality, integrity, and availability of protected information, and these vulnerabilities can be exploited remotely.

Recommendations For versions prior to 0.62, update to version 0.62 or later to resolve the issue. As a temporary workaround, consider restricting the number of connections to prevent the connection list from becoming full.

Fix

Related Identifiers

BDU:2015-03391

CVE-2003-0212

DSA-289

Affected Products

Rinetd

References · 9

• https://osv.dev/vulnerability/DEBIAN-CVE-2003-0212 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0212 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2003-0212 · Vendor Advisory
• http://debian.org/security/2003/dsa-289 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0212 · Security Note
• https://osv.dev/vulnerability/CVE-2003-0212 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03391 · Security Note
• http://marc.info/?l=bugtraq&m=105059298502830&w=2 · Note
• http://debian.org/security/dsa-289 · Note