CVE-2012-0862 — Improper Input Validation in Xinetd

CWE-20 — Improper Input Validation9 documents6 sources
Severity
4.3MEDIUMNVD
EPSS
0.5%
top 32.51%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
XinetdDebian Xinetd
Timeline
PublishedJun 4
Latest updateMay 17

Description

builtins.c in Xinetd before 2.3.15 does not check the service type when the tcpmux-server service is enabled, which exposes all enabled services and allows remote attackers to bypass intended access restrictions via a request to tcpmux port 1.

CVSS vector

AV:N/AC:M/C:P/I:N/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/xinetd< xinetd 1:2.3.14-7.1 (bookworm)
▶Debianxinetd/xinetd< 1:2.3.14-7.1+3
▶NVDxinetd/xinetd2.3.14+9

🔴Vulnerability Details

2
GHSA
GHSA-mv4c-6fpc-r32q: builtins↗2022-05-17
▶
OSV
CVE-2012-0862: builtins↗2012-06-04
▶

📋Vendor Advisories

3
Red Hat
xinetd: enables unintentional services over tcpmux port↗2012-05-09
▶
Debian
CVE-2012-0862: xinetd - builtins.c in Xinetd before 2.3.15 does not check the service type when the tcpm...↗2012
▶
Red Hat
kernel: excessive in kernel CPU consumption when creating large nested epoll structures↗2011-02-25
▶

💬Community

3
Bugzilla
CVE-2013-4342 xinetd: ignores user and group directives for tcpmux services↗2013-09-10
▶
Bugzilla
CVE-2012-0862 xinetd: enables unintentional services over tcpmux port [fedora-all]↗2012-05-09
▶
Bugzilla
CVE-2012-0862 xinetd: enables unintentional services over tcpmux port↗2012-02-15
▶
CVE-2012-0862 — Improper Input Validation in Xinetd | cvebase