CVE-2013-4342 — Incorrect Privilege Assignment in Xinetd
CWE-264CWE-266 — Incorrect Privilege AssignmentCWE-863 — Incorrect Authorization8 documents7 sources
Severity
7.6HIGHNVD
EPSS
15.3%
top 5.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedOct 10
Latest updateJun 11
Description
xinetd does not enforce the user and group configuration directives for TCPMUX services, which causes these services to be run as root and makes it easier for remote attackers to gain privileges by leveraging another vulnerability in a service.
CVSS vector
AV:N/AC:H/C:C/I:C/A:CExploitability: 4.9 | Impact: 10.0
Affected Packages8 packages
Also affects: Enterprise Linux 5, 6.0
Patches
🔴Vulnerability Details
2GHSA▶
GHSA-3vj5-whv8-66p9: xinetd does not enforce the user and group configuration directives for TCPMUX services, which causes these services to be run as root and makes it ea↗2022-05-14
OSV▶
CVE-2013-4342: xinetd does not enforce the user and group configuration directives for TCPMUX services, which causes these services to be run as root and makes it ea↗2013-10-10