PT-2012-2916 · Xinetd+3 · Xinetd+3

Thomas Swan · Published 2012-06-04 · Updated 2024-06-15 · CVE-2012-0862

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Xinetd versions prior to 2.3.15

Description The issue allows remote attackers to bypass intended access restrictions. This occurs because builtins.c in Xinetd does not check the service type when the tcpmux-server service is enabled, exposing all enabled services. Attackers can exploit this by sending a request to the tcpmux port.

Recommendations For versions prior to 2.3.15, update to version 2.3.15 or later to resolve the issue. As a temporary workaround, consider disabling the tcpmux-server service to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CESA-2013_0499

CVE-2012-0862

OPENSUSE-SU-2024:10323-1

RHSA-2013:0499

RHSA-2013:1302

RHSA-2013_0499

RHSA-2013_1302

SUSE-SU-2014_0466-1

SUSE-SU-2014_0871-1

Affected Products

Centos

Red Hat

Suse

Xinetd

References · 53

• https://bdu.fstec.ru/vul/2015-07635 · Security Note
• http://rhn.redhat.com/errata/RHSA-2013-1302.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081428.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-0862 · Security Note
• https://bdu.fstec.ru/vul/2015-09056 · Security Note
• https://linux.oracle.com/errata/ELSA-2013-0499.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10323-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2012:155 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4342 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0862 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081446.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-0862 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07636 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2012-0862 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-0862 · Vendor Advisory