Bug 488158 (CVE-2013-4342)

Summary:	<sys-apps/xinetd-2.3.15-r2: Privilege escalation (CVE-2013-4342)
Product:	Gentoo Security	Reporter:	GLSAMaker/CVETool Bot <glsamaker>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	base-system
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B1 [glsa]
Package list:		Runtime testing required:	---

Description GLSAMaker/CVETool Bot gentoo-dev

2013-10-16 02:17:19 UTC

CVE-2013-4342 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4342):
  xinetd does not enforce the user and group configuration directives for
  TCPMUX services, which causes these services to be run as root and makes it
  easier for remote attackers to gain privileges by leveraging another
  vulnerability in a service.

Comment 1 SpanKY gentoo-dev

2015-11-03 15:08:45 UTC

fix is in xinetd-2.3.15-r2 which may go stable at any time

http://gitweb.gentoo.org/repo/gentoo.git/commit/?id=426002bfe2789fb6213fba832c8bfee634d68d02

Comment 2 Agostino Sarubbo gentoo-dev

2015-11-03 17:13:14 UTC

amd64 stable

Comment 3 Agostino Sarubbo gentoo-dev

2015-11-03 17:14:24 UTC

x86 stable

Comment 4 Agostino Sarubbo gentoo-dev

2015-11-04 14:27:13 UTC

ppc stable

Comment 5 Agostino Sarubbo gentoo-dev

2015-11-05 10:59:14 UTC

sparc stable

Comment 6 Jeroen Roovers (RETIRED) gentoo-dev

2015-11-06 04:21:47 UTC

Stable for HPPA PPC64.

Comment 7 Markus Meier gentoo-dev

2015-11-14 16:46:12 UTC

arm stable

Comment 8 Matt Turner gentoo-dev

2015-11-15 18:27:28 UTC

alpha stable

Comment 9 Agostino Sarubbo gentoo-dev

2015-11-18 09:33:51 UTC

ia64 stable.

Maintainer(s), please cleanup.
Security, please add it to the existing request, or file a new one.

Comment 10 Yury German Gentoo Infrastructure

2015-12-23 23:25:30 UTC

Arches, Thank you for your work.
New GLSA Request filed.

Maintainer(s), please drop the vulnerable version(s).

Comment 11 Aaron Bauman (RETIRED) gentoo-dev

2016-02-21 13:22:39 UTC

vulnerable version 2.3.15-r1 still in tree.  Please clean.

Comment 12 Doug Goldstein (RETIRED) gentoo-dev

2016-02-21 21:22:20 UTC

Thanks for the report. re: http://gitweb.gentoo.org/repo/gentoo.git/commit/?id=dfb83dec9850f43ad7d9040309de4f7e139ad0e2

Comment 13 GLSAMaker/CVETool Bot gentoo-dev

2016-11-15 07:20:27 UTC

This issue was resolved and addressed in
 GLSA 201611-06 at https://security.gentoo.org/glsa/201611-06
by GLSA coordinator Aaron Bauman (b-man).