oss-security - CVE-2012-0862 assignment notification: xinetd enables unintentional services over tcpmux port

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4FAA8DCD.40305@redhat.com>
Date: Wed, 09 May 2012 17:31:25 +0200
From: Stefan Cornelius <scorneli@...hat.com>
To: oss-security@...ts.openwall.com
CC: thomas.swan@...il.com, bbraun@...ack.net
Subject: CVE-2012-0862 assignment notification: xinetd enables unintentional
 services over tcpmux port

Hi,

Thomas Swan of FedEx reported a service disclosure flaw in xinetd.
xinetd allows for services to be configured with the TCPMUX or
TCPMUXPLUS service types, which makes those services available on port
1, as per RFC 1078 [1], if the tcpmux-server service is enabled.  When
the tcpmux-server service is enabled, xinetd would expose _all_ enabled
services via the tcpmux port, instead of just the configured service(s).
This could allow a remote attacker to bypass firewall restrictions and
access services via the tcpmux port.

In order for enabled services handled by xinetd to be exposed via the
tcpmux port, the tcpmux-server service must be enabled (by default it is
disabled).

This has been assigned CVE-2012-0862.

Thomas Swan also provided a patch [2], which has been reviewed by a
former xinetd upstream maintainer and the Red Hat xinetd maintainer
(upstream didn't respond to our contact attempts).

-- References --

[1] Red Hat bug:
https://bugzilla.redhat.com/show_bug.cgi?id=790940

[2] Proposed patch:
https://bugzilla.redhat.com/attachment.cgi?id=583311

Thanks and kind regards,
-- 
Stefan Cornelius / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.