builtins.c in Xinetd before 2.3.15 does not check the service type when the tcpmux-server service is enabled, which exposes all enabled services and allows remote attackers to bypass intended access restrictions via a request to tcpmux port 1.

Xinetd receives a LTSS roll-up update to fix two security issues.

  - CVE-2012-0862: xinetd enabled all services when tcp     multiplexing is used.

  - CVE-2013-4342: xinetd ignored user and group directives     for tcpmux services, running services as root.

While both issues are not so problematic on their own, in combination the impact is greater and enabling tcpmux would be risky.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An updated xinetd package that fixes one security issue and two bugs is now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The xinetd package provides a secure replacement for inetd, the Internet services daemon. xinetd provides access control for all services based on the address of the remote host and/or on time of access, and can prevent denial-of-access attacks.

When xinetd services are configured with the 'TCPMUX' or 'TCPMUXPLUS' type, and the tcpmux-server service is enabled, those services are accessible via port 1. It was found that enabling the tcpmux-server service (it is disabled by default) allowed every xinetd service, including those that are not configured with the 'TCPMUX' or 'TCPMUXPLUS' type, to be accessible via port 1. This could allow a remote attacker to bypass intended firewall restrictions.
(CVE-2012-0862)

Red Hat would like to thank Thomas Swan of FedEx for reporting this issue.

This update also fixes the following bugs :

* Prior to this update, a file descriptor array in the service.c source file was not handled as expected. As a consequence, some of the descriptors remained open when xinetd was under heavy load.
Additionally, the system log was filled with a large number of messages that took up a lot of disk space over time. This update modifies the xinetd code to handle the file descriptors correctly and messages no longer fill the system log. (BZ#852274)

* Prior to this update, services were disabled permanently when their CPS limit was reached. As a consequence, a failed bind operation could occur when xinetd attempted to restart the service. This update adds additional logic that attempts to restart the service. Now, the service is only disabled if xinetd cannot restart the service after 30 attempts. (BZ#811000)

All users of xinetd are advised to upgrade to this updated package, which contains backported patches to correct these issues.

xinetd was updated to receive security fixes and a bug fix.

Security issues fixed :

  - CVE-2013-4342 (bnc#844230)

  - xinetd ignored user and group directives for tcpmux     services

  - CVE-2012-0862 (bnc#762294)

  - xinetd enabled all services when tcp multiplexing is     used

Also added support for setting maximum number of open files (bnc#855685).

The multiplexing system xinetd was updated to fix security issues and a bug.

Security issues fixed :

  - xinetd ignores user and group directives for tcpmux     services. (CVE-2013-4342)

  - xinetd enables all services when tcp multiplexing is     used. Bug fixed:. (CVE-2012-0862)

  - Services started by xinetd were limited to 1024 open     file descriptors. (bnc#855685)

When xinetd services are configured with the 'TCPMUX' or 'TCPMUXPLUS' type, and the tcpmux-server service is enabled, those services are accessible via port 1. It was found that enabling the tcpmux-server service (it is disabled by default) allowed every xinetd service, including those that are not configured with the 'TCPMUX' or 'TCPMUXPLUS' type, to be accessible via port 1. This could allow a remote attacker to bypass intended firewall restrictions.
(CVE-2012-0862)

This update also fixes the following bugs :

  - Prior to this update, a file descriptor array in the     service.c source file was not handled as expected. As a     consequence, some of the descriptors remained open when     xinetd was under heavy load. Additionally, the system     log was filled with a large number of messages that took     up a lot of disk space over time. This update modifies     the xinetd code to handle the file descriptors correctly     and messages no longer fill the system log.

  - Prior to this update, services were disabled permanently     when their CPS limit was reached. As a consequence, a     failed bind operation could occur when xinetd attempted     to restart the service. This update adds additional     logic that attempts to restart the service. Now, the     service is only disabled if xinetd cannot restart the     service after 30 attempts.

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2013-1302 advisory.

    [2:2.3.14-19]
    - Correctly backport patches that fix the descriptor leakage
    - Related: #852274

    [-2:2.3.14-18]
    - Fix leaking file descriptors (#852274)
    - Fix: Service disabled due to bind failure (#811000)
    - CVE-2012-0862 xinetd: enables unintentional services over tcpmux port (#788795)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2013-0499 advisory.

    - CVE-2012-0862 xinetd: enables unintentional services over tcpmux port

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A security issue was identified and fixed in xinetd :

builtins.c in Xinetd before 2.3.15 does not check the service type when the tcpmux-server service is enabled, which exposes all enabled services and allows remote attackers to bypass intended access restrictions via a request to tcpmux port 1 (CVE-2012-0862).

The updated packages have been upgraded to the 2.3.15 version which is not vulnerble to this issue.

An updated xinetd package that fixes one security issue and two bugs is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The xinetd package provides a secure replacement for inetd, the Internet services daemon. xinetd provides access control for all services based on the address of the remote host and/or on time of access, and can prevent denial-of-access attacks.

When xinetd services are configured with the 'TCPMUX' or 'TCPMUXPLUS' type, and the tcpmux-server service is enabled, those services are accessible via port 1. It was found that enabling the tcpmux-server service (it is disabled by default) allowed every xinetd service, including those that are not configured with the 'TCPMUX' or 'TCPMUXPLUS' type, to be accessible via port 1. This could allow a remote attacker to bypass intended firewall restrictions.
(CVE-2012-0862)

Red Hat would like to thank Thomas Swan of FedEx for reporting this issue.

This update also fixes the following bugs :

* Prior to this update, a file descriptor array in the service.c source file was not handled as expected. As a consequence, some of the descriptors remained open when xinetd was under heavy load.
Additionally, the system log was filled with a large number of messages that took up a lot of disk space over time. This update modifies the xinetd code to handle the file descriptors correctly and messages no longer fill the system log. (BZ#790036)

* Prior to this update, services were disabled permanently when their CPS limit was reached. As a consequence, a failed bind operation could occur when xinetd attempted to restart the service. This update adds additional logic that attempts to restart the service. Now, the service is only disabled if xinetd cannot restart the service after 30 attempts. (BZ#809271)

All users of xinetd are advised to upgrade to this updated package, which contains backported patches to correct these issues.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2013:0499 advisory.

    The xinetd package provides a secure replacement for inetd, the Internet     services daemon. xinetd provides access control for all services based on     the address of the remote host and/or on time of access, and can prevent     denial-of-access attacks.

    When xinetd services are configured with the TCPMUX or TCPMUXPLUS type,     and the tcpmux-server service is enabled, those services are accessible via     port 1. It was found that enabling the tcpmux-server service (it is     disabled by default) allowed every xinetd service, including those that are     not configured with the TCPMUX or TCPMUXPLUS type, to be accessible via     port 1. This could allow a remote attacker to bypass intended firewall     restrictions. (CVE-2012-0862)

    Red Hat would like to thank Thomas Swan of FedEx for reporting this issue.

    This update also fixes the following bugs:

    * Prior to this update, a file descriptor array in the service.c source     file was not handled as expected. As a consequence, some of the descriptors     remained open when xinetd was under heavy load. Additionally, the system     log was filled with a large number of messages that took up a lot of disk     space over time. This update modifies the xinetd code to handle the file     descriptors correctly and messages no longer fill the system log.
    (BZ#790036)

    * Prior to this update, services were disabled permanently when their CPS     limit was reached. As a consequence, a failed bind operation could occur     when xinetd attempted to restart the service. This update adds additional     logic that attempts to restart the service. Now, the service is only     disabled if xinetd cannot restart the service after 30 attempts.
    (BZ#809271)

    All users of xinetd are advised to upgrade to this updated package, which     contains backported patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Thomas Swan reports :

xinetd allows for services to be configured with the TCPMUX or TCPMUXPLUS service types, which makes those services available on port 1, as per RFC 1078 [1], if the tcpmux-server service is enabled. When the tcpmux-server service is enabled, xinetd would expose _all_ enabled services via the tcpmux port, instead of just the configured service(s). This could allow a remote attacker to bypass firewall restrictions and access services via the tcpmux port.

A security issue was identified and fixed in xinetd :

builtins.c in Xinetd before 2.3.15 does not check the service type when the tcpmux-server service is enabled, which exposes all enabled services and allows remote attackers to bypass intended access restrictions via a request to tcpmux port 1 (CVE-2012-0862).

The updated packages have been patched to correct this issue.

Fix tcpmux security

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
83631	SUSE SLES10 / SLES11 Security Update : xinetd (SUSE-SU-2014:0871-1)	Nessus	SuSE Local Security Checks	high
79148	CentOS 5 : xinetd (CESA-2013:1302)	Nessus	CentOS Local Security Checks	medium
75322	openSUSE Security Update : xinetd (openSUSE-SU-2014:0517-1)	Nessus	SuSE Local Security Checks	high
73287	SuSE 11.3 Security Update : xinetd (SAT Patch Number 9021)	Nessus	SuSE Local Security Checks	high
70364	Scientific Linux Security Update : xinetd on SL5.x i386/x86_64 (20130930)	Nessus	Scientific Linux Local Security Checks	medium
70283	Oracle Linux 5 : xinetd (ELSA-2013-1302)	Nessus	Oracle Linux Local Security Checks	critical
70243	RHEL 5 : xinetd (RHSA-2013:1302)	Nessus	Red Hat Local Security Checks	medium
68740	Oracle Linux 6 : xinetd (ELSA-2013-0499)	Nessus	Oracle Linux Local Security Checks	critical
66071	Mandriva Linux Security Advisory : xinetd (MDVSA-2013:057)	Nessus	Mandriva Local Security Checks	medium
65135	CentOS 6 : xinetd (CESA-2013:0499)	Nessus	CentOS Local Security Checks	medium
64961	Scientific Linux Security Update : xinetd on SL6.x i386/x86_64 (20130221)	Nessus	Scientific Linux Local Security Checks	medium
64751	RHEL 6 : xinetd (RHSA-2013:0499)	Nessus	Red Hat Local Security Checks	critical
62612	FreeBSD : xinetd -- attackers can bypass access restrictions if tcpmux-servers service enabled (e11955ca-187c-11e2-be36-00215af774f0)	Nessus	FreeBSD Local Security Checks	medium
62403	Mandriva Linux Security Advisory : xinetd (MDVSA-2012:155-1)	Nessus	Mandriva Local Security Checks	medium
59298	Fedora 16 : xinetd-2.3.14-47.fc16 (2012-8061)	Nessus	Fedora Local Security Checks	medium
59297	Fedora 15 : xinetd-2.3.14-37.fc15 (2012-8041)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2012-0862

critical

Tenable Plugins

high

medium

high

high

medium

critical

medium

critical

medium

medium

medium

critical

medium

medium

medium

medium