Bug 488158 – <sys-apps/xinetd-2.3.15-r2: Privilege escalation (CVE-2013-4342)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description GLSAMaker/CVETool Bot 2013-10-16 02:17:19 UTC]

CVE-2013-4342 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4342):
  xinetd does not enforce the user and group configuration directives for
  TCPMUX services, which causes these services to be run as root and makes it
  easier for remote attackers to gain privileges by leveraging another
  vulnerability in a service.

[Comment 1 SpanKY 2015-11-03 15:08:45 UTC]

fix is in xinetd-2.3.15-r2 which may go stable at any time

http://gitweb.gentoo.org/repo/gentoo.git/commit/?id=426002bfe2789fb6213fba832c8bfee634d68d02

[Comment 2 Agostino Sarubbo 2015-11-03 17:13:14 UTC]

amd64 stable

[Comment 3 Agostino Sarubbo 2015-11-03 17:14:24 UTC]

x86 stable

[Comment 4 Agostino Sarubbo 2015-11-04 14:27:13 UTC]

ppc stable

[Comment 5 Agostino Sarubbo 2015-11-05 10:59:14 UTC]

sparc stable

[Comment 6 Jeroen Roovers (RETIRED) 2015-11-06 04:21:47 UTC]

Stable for HPPA PPC64.

[Comment 7 Markus Meier 2015-11-14 16:46:12 UTC]

arm stable

[Comment 8 Matt Turner 2015-11-15 18:27:28 UTC]

alpha stable

[Comment 9 Agostino Sarubbo 2015-11-18 09:33:51 UTC]

ia64 stable.

Maintainer(s), please cleanup.
Security, please add it to the existing request, or file a new one.

[Comment 10 Yury German 2015-12-23 23:25:30 UTC]

Arches, Thank you for your work.
New GLSA Request filed.

Maintainer(s), please drop the vulnerable version(s).

[Comment 11 Aaron Bauman (RETIRED) 2016-02-21 13:22:39 UTC]

vulnerable version 2.3.15-r1 still in tree.  Please clean.

[Comment 12 Doug Goldstein (RETIRED) 2016-02-21 21:22:20 UTC]

Thanks for the report. re: http://gitweb.gentoo.org/repo/gentoo.git/commit/?id=dfb83dec9850f43ad7d9040309de4f7e139ad0e2

[Comment 13 GLSAMaker/CVETool Bot 2016-11-15 07:20:27 UTC]

This issue was resolved and addressed in
 GLSA 201611-06 at https://security.gentoo.org/glsa/201611-06
by GLSA coordinator Aaron Bauman (b-man).