builtins.c in Xinetd before 2.3.15 does not check the service type when the tcpmux-server service is enabled, which exposes all enabled services and allows remote attackers to bypass intended access restrictions via a request to tcpmux port 1.

Xinetd receives a LTSS roll-up update to fix two security issues.

  - CVE-2012-0862: xinetd enabled all services when tcp     multiplexing is used.

  - CVE-2013-4342: xinetd ignored user and group directives     for tcpmux services, running services as root.

While both issues are not so problematic on their own, in combination the impact is greater and enabling tcpmux would be risky.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An updated xinetd package that fixes one security issue and two bugs is now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The xinetd package provides a secure replacement for inetd, the Internet services daemon. xinetd provides access control for all services based on the address of the remote host and/or on time of access, and can prevent denial-of-access attacks.

When xinetd services are configured with the 'TCPMUX' or 'TCPMUXPLUS' type, and the tcpmux-server service is enabled, those services are accessible via port 1. It was found that enabling the tcpmux-server service (it is disabled by default) allowed every xinetd service, including those that are not configured with the 'TCPMUX' or 'TCPMUXPLUS' type, to be accessible via port 1. This could allow a remote attacker to bypass intended firewall restrictions.
(CVE-2012-0862)

Red Hat would like to thank Thomas Swan of FedEx for reporting this issue.

This update also fixes the following bugs :

* Prior to this update, a file descriptor array in the service.c source file was not handled as expected. As a consequence, some of the descriptors remained open when xinetd was under heavy load.
Additionally, the system log was filled with a large number of messages that took up a lot of disk space over time. This update modifies the xinetd code to handle the file descriptors correctly and messages no longer fill the system log. (BZ#852274)

* Prior to this update, services were disabled permanently when their CPS limit was reached. As a consequence, a failed bind operation could occur when xinetd attempted to restart the service. This update adds additional logic that attempts to restart the service. Now, the service is only disabled if xinetd cannot restart the service after 30 attempts. (BZ#811000)

All users of xinetd are advised to upgrade to this updated package, which contains backported patches to correct these issues.

xinetd was updated to receive security fixes and a bug fix.

Security issues fixed :

  - CVE-2013-4342 (bnc#844230)

  - xinetd ignored user and group directives for tcpmux     services

  - CVE-2012-0862 (bnc#762294)

  - xinetd enabled all services when tcp multiplexing is     used

Also added support for setting maximum number of open files (bnc#855685).

The multiplexing system xinetd was updated to fix security issues and a bug.

Security issues fixed :

  - xinetd ignores user and group directives for tcpmux     services. (CVE-2013-4342)

  - xinetd enables all services when tcp multiplexing is     used. Bug fixed:. (CVE-2012-0862)

  - Services started by xinetd were limited to 1024 open     file descriptors. (bnc#855685)

When xinetd services are configured with the 'TCPMUX' or 'TCPMUXPLUS' type, and the tcpmux-server service is enabled, those services are accessible via port 1. It was found that enabling the tcpmux-server service (it is disabled by default) allowed every xinetd service, including those that are not configured with the 'TCPMUX' or 'TCPMUXPLUS' type, to be accessible via port 1. This could allow a remote attacker to bypass intended firewall restrictions.
(CVE-2012-0862)

This update also fixes the following bugs :

  - Prior to this update, a file descriptor array in the     service.c source file was not handled as expected. As a     consequence, some of the descriptors remained open when     xinetd was under heavy load. Additionally, the system     log was filled with a large number of messages that took     up a lot of disk space over time. This update modifies     the xinetd code to handle the file descriptors correctly     and messages no longer fill the system log.

  - Prior to this update, services were disabled permanently     when their CPS limit was reached. As a consequence, a     failed bind operation could occur when xinetd attempted     to restart the service. This update adds additional     logic that attempts to restart the service. Now, the     service is only disabled if xinetd cannot restart the     service after 30 attempts.

From Red Hat Security Advisory 2013:1302 :

An updated xinetd package that fixes one security issue and two bugs is now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The xinetd package provides a secure replacement for inetd, the Internet services daemon. xinetd provides access control for all services based on the address of the remote host and/or on time of access, and can prevent denial-of-access attacks.

When xinetd services are configured with the 'TCPMUX' or 'TCPMUXPLUS' type, and the tcpmux-server service is enabled, those services are accessible via port 1. It was found that enabling the tcpmux-server service (it is disabled by default) allowed every xinetd service, including those that are not configured with the 'TCPMUX' or 'TCPMUXPLUS' type, to be accessible via port 1. This could allow a remote attacker to bypass intended firewall restrictions.
(CVE-2012-0862)

Red Hat would like to thank Thomas Swan of FedEx for reporting this issue.

This update also fixes the following bugs :

* Prior to this update, a file descriptor array in the service.c source file was not handled as expected. As a consequence, some of the descriptors remained open when xinetd was under heavy load.
Additionally, the system log was filled with a large number of messages that took up a lot of disk space over time. This update modifies the xinetd code to handle the file descriptors correctly and messages no longer fill the system log. (BZ#852274)

* Prior to this update, services were disabled permanently when their CPS limit was reached. As a consequence, a failed bind operation could occur when xinetd attempted to restart the service. This update adds additional logic that attempts to restart the service. Now, the service is only disabled if xinetd cannot restart the service after 30 attempts. (BZ#811000)

All users of xinetd are advised to upgrade to this updated package, which contains backported patches to correct these issues.

From Red Hat Security Advisory 2013:0499 :

An updated xinetd package that fixes one security issue and two bugs is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The xinetd package provides a secure replacement for inetd, the Internet services daemon. xinetd provides access control for all services based on the address of the remote host and/or on time of access, and can prevent denial-of-access attacks.

When xinetd services are configured with the 'TCPMUX' or 'TCPMUXPLUS' type, and the tcpmux-server service is enabled, those services are accessible via port 1. It was found that enabling the tcpmux-server service (it is disabled by default) allowed every xinetd service, including those that are not configured with the 'TCPMUX' or 'TCPMUXPLUS' type, to be accessible via port 1. This could allow a remote attacker to bypass intended firewall restrictions.
(CVE-2012-0862)

Red Hat would like to thank Thomas Swan of FedEx for reporting this issue.

This update also fixes the following bugs :

* Prior to this update, a file descriptor array in the service.c source file was not handled as expected. As a consequence, some of the descriptors remained open when xinetd was under heavy load.
Additionally, the system log was filled with a large number of messages that took up a lot of disk space over time. This update modifies the xinetd code to handle the file descriptors correctly and messages no longer fill the system log. (BZ#790036)

* Prior to this update, services were disabled permanently when their CPS limit was reached. As a consequence, a failed bind operation could occur when xinetd attempted to restart the service. This update adds additional logic that attempts to restart the service. Now, the service is only disabled if xinetd cannot restart the service after 30 attempts. (BZ#809271)

All users of xinetd are advised to upgrade to this updated package, which contains backported patches to correct these issues.

A security issue was identified and fixed in xinetd :

builtins.c in Xinetd before 2.3.15 does not check the service type when the tcpmux-server service is enabled, which exposes all enabled services and allows remote attackers to bypass intended access restrictions via a request to tcpmux port 1 (CVE-2012-0862).

The updated packages have been upgraded to the 2.3.15 version which is not vulnerble to this issue.

An updated xinetd package that fixes one security issue and two bugs is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The xinetd package provides a secure replacement for inetd, the Internet services daemon. xinetd provides access control for all services based on the address of the remote host and/or on time of access, and can prevent denial-of-access attacks.

When xinetd services are configured with the 'TCPMUX' or 'TCPMUXPLUS' type, and the tcpmux-server service is enabled, those services are accessible via port 1. It was found that enabling the tcpmux-server service (it is disabled by default) allowed every xinetd service, including those that are not configured with the 'TCPMUX' or 'TCPMUXPLUS' type, to be accessible via port 1. This could allow a remote attacker to bypass intended firewall restrictions.
(CVE-2012-0862)

Red Hat would like to thank Thomas Swan of FedEx for reporting this issue.

This update also fixes the following bugs :

* Prior to this update, a file descriptor array in the service.c source file was not handled as expected. As a consequence, some of the descriptors remained open when xinetd was under heavy load.
Additionally, the system log was filled with a large number of messages that took up a lot of disk space over time. This update modifies the xinetd code to handle the file descriptors correctly and messages no longer fill the system log. (BZ#790036)

* Prior to this update, services were disabled permanently when their CPS limit was reached. As a consequence, a failed bind operation could occur when xinetd attempted to restart the service. This update adds additional logic that attempts to restart the service. Now, the service is only disabled if xinetd cannot restart the service after 30 attempts. (BZ#809271)

All users of xinetd are advised to upgrade to this updated package, which contains backported patches to correct these issues.

Thomas Swan reports :

xinetd allows for services to be configured with the TCPMUX or TCPMUXPLUS service types, which makes those services available on port 1, as per RFC 1078 [1], if the tcpmux-server service is enabled. When the tcpmux-server service is enabled, xinetd would expose _all_ enabled services via the tcpmux port, instead of just the configured service(s). This could allow a remote attacker to bypass firewall restrictions and access services via the tcpmux port.

A security issue was identified and fixed in xinetd :

builtins.c in Xinetd before 2.3.15 does not check the service type when the tcpmux-server service is enabled, which exposes all enabled services and allows remote attackers to bypass intended access restrictions via a request to tcpmux port 1 (CVE-2012-0862).

The updated packages have been patched to correct this issue.

Fix tcpmux security

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
83631	SUSE SLES10 / SLES11 Security Update : xinetd (SUSE-SU-2014:0871-1)	Nessus	SuSE Local Security Checks	high
79148	CentOS 5 : xinetd (CESA-2013:1302)	Nessus	CentOS Local Security Checks	medium
75322	openSUSE Security Update : xinetd (openSUSE-SU-2014:0517-1)	Nessus	SuSE Local Security Checks	high
73287	SuSE 11.3 Security Update : xinetd (SAT Patch Number 9021)	Nessus	SuSE Local Security Checks	high
70364	Scientific Linux Security Update : xinetd on SL5.x i386/x86_64 (20130930)	Nessus	Scientific Linux Local Security Checks	medium
70283	Oracle Linux 5 : xinetd (ELSA-2013-1302)	Nessus	Oracle Linux Local Security Checks	medium
70243	RHEL 5 : xinetd (RHSA-2013:1302)	Nessus	Red Hat Local Security Checks	medium
68740	Oracle Linux 6 : xinetd (ELSA-2013-0499)	Nessus	Oracle Linux Local Security Checks	medium
66071	Mandriva Linux Security Advisory : xinetd (MDVSA-2013:057)	Nessus	Mandriva Local Security Checks	medium
65135	CentOS 6 : xinetd (CESA-2013:0499)	Nessus	CentOS Local Security Checks	medium
64961	Scientific Linux Security Update : xinetd on SL6.x i386/x86_64 (20130221)	Nessus	Scientific Linux Local Security Checks	medium
64751	RHEL 6 : xinetd (RHSA-2013:0499)	Nessus	Red Hat Local Security Checks	medium
62612	FreeBSD : xinetd -- attackers can bypass access restrictions if tcpmux-servers service enabled (e11955ca-187c-11e2-be36-00215af774f0)	Nessus	FreeBSD Local Security Checks	medium
62403	Mandriva Linux Security Advisory : xinetd (MDVSA-2012:155-1)	Nessus	Mandriva Local Security Checks	medium
59298	Fedora 16 : xinetd-2.3.14-47.fc16 (2012-8061)	Nessus	Fedora Local Security Checks	medium
59297	Fedora 15 : xinetd-2.3.14-37.fc15 (2012-8041)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2012-0862

critical

Tenable Plugins

high

medium

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium