CVE-2013-4342

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2013-4342
xinetd does not enforce the user and group configuration directives for TCPMUX services, which causes these services to be run as root and makes it easier for remote attackers to gain privileges by leveraging another vulnerability in a service.

7.6 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:H/Au:N/C:C/I:C/A:C

Exploitability : 4.9 / Impact : 10.0

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://rhn.redhat.com/errata/RHSA-2013-1409.html
https://bugzilla.redhat.com/show_bug.cgi?id=1006100 Exploit Patch
https://github.com/xinetd-org/xinetd/pull/10
https://security.gentoo.org/glsa/201611-06
Configurations

Configuration 1 (hide)

cpe:2.3:a:xinetd:xinetd:-:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:redhat:enterprise_linux:5:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
History

13 Feb 2023, 04:46

Type Values Removed Values Added
References
  • {'url': 'https://access.redhat.com/security/cve/CVE-2013-4342', 'name': 'https://access.redhat.com/security/cve/CVE-2013-4342', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2013:1409', 'name': 'https://access.redhat.com/errata/RHSA-2013:1409', 'tags': [], 'refsource': 'MISC'}
Summary CVE-2013-4342 xinetd: ignores user and group directives for tcpmux services xinetd does not enforce the user and group configuration directives for TCPMUX services, which causes these services to be run as root and makes it easier for remote attackers to gain privileges by leveraging another vulnerability in a service.

02 Feb 2023, 20:15

Type Values Removed Values Added
Summary xinetd does not enforce the user and group configuration directives for TCPMUX services, which causes these services to be run as root and makes it easier for remote attackers to gain privileges by leveraging another vulnerability in a service. CVE-2013-4342 xinetd: ignores user and group directives for tcpmux services
References
  • (MISC) https://access.redhat.com/security/cve/CVE-2013-4342 -
  • (MISC) https://access.redhat.com/errata/RHSA-2013:1409 -
Information

Published : 2013-10-10 00:55

Updated : 2023-12-10 11:16

NVD link : CVE-2013-4342

Mitre link : CVE-2013-4342

CVE.ORG link : CVE-2013-4342

JSON object : View

Products Affected

redhat

  • enterprise_linux

xinetd

  • xinetd
CWE
CWE-264

Permissions, Privileges, and Access Controls