DSA-151-1 xinetd -- pipe exposure

Debian Security Advisory

DSA-151-1 xinetd -- pipe exposure

Date Reported:

13 Aug 2002

Affected Packages:

xinetd

Vulnerable:

Yes

Security database references:

In the Bugtraq database (at SecurityFocus): BugTraq ID 5458.
In Mitre's CVE dictionary: CVE-2002-0871.

More information:

Solar Designer found a vulnerability in xinetd, a replacement for the BSD derived inetd. File descriptors for the signal pipe introduced in version 2.3.4 are leaked into services started from xinetd. The descriptors could be used to talk to xinetd resulting in crashing it entirely. This is usually called a denial of service.

This problem has been fixed by the package maintainer in version 2.3.4-1.2 for the current stable distribution (woody) and in version 2.3.7-1 for the unstable distribution (sid). The old stable distribution (potato) is not affected, since it doesn't contain the signal pipe.

We recommend that you upgrade your xinetd packages.

Fixed in:

Debian GNU/Linux 3.0 (woody)

Source:

http://security.debian.org/pool/updates/main/x/xinetd/xinetd_2.3.4-1.2.dsc

http://security.debian.org/pool/updates/main/x/xinetd/xinetd_2.3.4-1.2.diff.gz

http://security.debian.org/pool/updates/main/x/xinetd/xinetd_2.3.4.orig.tar.gz

Alpha:

http://security.debian.org/pool/updates/main/x/xinetd/xinetd_2.3.4-1.2_alpha.deb

ARM:

http://security.debian.org/pool/updates/main/x/xinetd/xinetd_2.3.4-1.2_arm.deb

Intel IA-32:

http://security.debian.org/pool/updates/main/x/xinetd/xinetd_2.3.4-1.2_i386.deb

Intel IA-64:

http://security.debian.org/pool/updates/main/x/xinetd/xinetd_2.3.4-1.2_ia64.deb

HP Precision:

http://security.debian.org/pool/updates/main/x/xinetd/xinetd_2.3.4-1.2_hppa.deb

Motorola 680x0:

http://security.debian.org/pool/updates/main/x/xinetd/xinetd_2.3.4-1.2_m68k.deb

Big endian MIPS:

http://security.debian.org/pool/updates/main/x/xinetd/xinetd_2.3.4-1.2_mips.deb

Little endian MIPS:

http://security.debian.org/pool/updates/main/x/xinetd/xinetd_2.3.4-1.2_mipsel.deb

PowerPC:

http://security.debian.org/pool/updates/main/x/xinetd/xinetd_2.3.4-1.2_powerpc.deb

IBM S/390:

http://security.debian.org/pool/updates/main/x/xinetd/xinetd_2.3.4-1.2_s390.deb

Sun Sparc:

http://security.debian.org/pool/updates/main/x/xinetd/xinetd_2.3.4-1.2_sparc.deb

MD5 checksums of the listed files are available in the original advisory.