diff options
| author | sem <sem@FreeBSD.org> | 2012-10-18 01:22:51 +0800 |
|---|---|---|
| committer | sem <sem@FreeBSD.org> | 2012-10-18 01:22:51 +0800 |
| commit | 770d047266f4ea7d7df80f37377e4181eeb3ce6d (patch) | |
| tree | f79c560e699a7465221ee2e15bd41b73999c7e97 /security | |
| parent | 8e197aa7ab5919e39e384109555acb97a106f48f (diff) | |
| download | freebsd-ports-gnome-770d047266f4ea7d7df80f37377e4181eeb3ce6d.tar.gz freebsd-ports-gnome-770d047266f4ea7d7df80f37377e4181eeb3ce6d.tar.zst freebsd-ports-gnome-770d047266f4ea7d7df80f37377e4181eeb3ce6d.zip | |
- xinetd vulnerability
Feature safe: yes
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln.xml | 33 |
1 files changed, 33 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index f00c35c5879f..0248f8cbc270 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -51,6 +51,39 @@ Note: Please add new entries to the beginning of this file. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="e11955ca-187c-11e2-be36-00215af774f0"> + <topic>xinetd -- attackers can bypass access restrictions if tcpmux-servers service enabled</topic> + <affects> + <package> + <name>xinetd</name> + <range><lt>2.3.15</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Thomas Swan reports:</p> + <blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=790940"> + <p>xinetd allows for services to be configured with the TCPMUX + or TCPMUXPLUS service types, which makes those services + available on port 1, as per RFC 1078 [1], if the tcpmux-server + service is enabled. When the tcpmux-server service is enabled, + xinetd would expose _all_ enabled services via the tcpmux port, + instead of just the configured service(s). This could allow + a remote attacker to bypass firewall restrictions and access + services via the tcpmux port.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2012-0862</cvename> + <url>https://bugzilla.redhat.com/show_bug.cgi?id=790940</url> + </references> + <dates> + <discovery>2012-02-15</discovery> + <entry>2012-10-17</entry> + </dates> + </vuln> + <vuln vid="ec34d0c2-1799-11e2-b4ab-000c29033c32"> <topic>Zend Framework -- Multiple vulnerabilities via XXE injection</topic> <affects> |