The remote MiracleLinux 4 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2014-006:01 advisory.

    Xinetd is a secure replacement for inetd, the Internet services daemon. Xinetd provides access control for     all services based on the address of the remote host and/or on time of access and can prevent denial-of-     access attacks. Xinetd provides extensive logging, has no limit on the number of server arguments, and     lets you bind specific services to specific IP addresses on your host machine. Each service has its own     specific configuration file for Xinetd; the files are located in the /etc/xinetd.d directory.
    Security issues fixed with this release:
     CVE-2013-4342     xinetd does not enforce the user and group configuration directives for TCPMUX services, which causes     these services to be run as root and makes it easier for remote attackers to gain privileges by leveraging     another vulnerability in a service.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 / 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2013-1409 advisory.

    [2:2.3.14-39]
    - Honor user and group directives
    - Resolves: CVE-2013-4342

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

CVE-2013-4342 xinetd: ignores user and group directives for tcpmux services

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201611-06 (xinetd: Privilege escalation)

    Xinetd does not enforce the user and group configuration directives for       TCPMUX services, which causes these services to be run as root.
  Impact :

    Attackers could escalate privileges outside of the running process.
  Workaround :

    There is no known workaround at this time.

An updated xinetd package that fixes one security issue is now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The xinetd package provides a secure replacement for inetd, the Internet services daemon. xinetd provides access control for all services based on the address of the remote host and/or on time of access, and can prevent denial-of-access attacks.

It was found that xinetd ignored the user and group configuration directives for services running under the tcpmux-server service. This flaw could cause the associated services to run as root. If there was a flaw in such a service, a remote attacker could use it to execute arbitrary code with the privileges of the root user. (CVE-2013-4342)

Red Hat would like to thank Thomas Swan of FedEx for reporting this issue.

All xinetd users are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

It was found that xinetd ignored the user and group configuration directives for services running under the tcpmux-server service. This flaw could cause the associated services to run as root. If there was a flaw in such a service, a remote attacker could use it to execute arbitrary code with the privileges of the root user. (CVE-2013-4342)

An update of the xinetd package has been released.

The version of xinetd installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2013-4342 advisory.

  - xinetd does not enforce the user and group configuration directives for TCPMUX services, which causes     these services to be run as root and makes it easier for remote attackers to gain privileges by leveraging     another vulnerability in a service. (CVE-2013-4342)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated xinetd package fixes security vulnerability :

It was found that xinetd ignored the user and group configuration directives for services running under the tcpmux-server service. This flaw could cause the associated services to run as root. If there was a flaw in such a service, a remote attacker could use it to execute arbitrary code with the privileges of the root user (CVE-2013-4342).

xinetd was updated to receive security fixes and a bug fix.

Security issues fixed :

  - CVE-2013-4342 (bnc#844230)

  - xinetd ignored user and group directives for tcpmux     services

  - CVE-2012-0862 (bnc#762294)

  - xinetd enabled all services when tcp multiplexing is     used

Also added support for setting maximum number of open files (bnc#855685).

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
288914	MiracleLinux 4 : xinetd-2.3.14-39.AXS4 (AXSA:2014-006:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
70326	Oracle Linux 5 / 6 : xinetd (ELSA-2013-1409)	Nessus	Oracle Linux Local Security Checks	2013/10/8	2025/4/29	critical
70406	Fedora 19 : xinetd-2.3.15-8.fc19 (2013-18243)	Nessus	Fedora Local Security Checks	2013/10/13	2021/1/11	high
94890	GLSA-201611-06 : xinetd: Privilege escalation	Nessus	Gentoo Local Security Checks	2016/11/15	2026/1/19	high
70344	CentOS 5 / 6 : xinetd (CESA-2013:1409)	Nessus	CentOS Local Security Checks	2013/10/9	2021/1/4	high
70405	Fedora 20 : xinetd-2.3.15-8.fc20 (2013-18241)	Nessus	Fedora Local Security Checks	2013/10/13	2021/1/11	high
70568	Amazon Linux AMI : xinetd (ALAS-2013-232)	Nessus	Amazon Linux Local Security Checks	2013/10/24	2018/4/18	high
204374	Photon OS 4.0: Xinetd PHSA-2023-4.0-0449	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	critical
201757	CBL Mariner 2.0 Security Update: xinetd (CVE-2013-4342)	Nessus	MarinerOS Local Security Checks	2024/7/3	2024/7/3	critical
204558	Photon OS 5.0: Xinetd PHSA-2023-5.0-0060	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	critical
70327	RHEL 5 / 6 : xinetd (RHSA-2013:1409)	Nessus	Red Hat Local Security Checks	2013/10/8	2021/1/14	high
70384	Mandriva Linux Security Advisory : xinetd (MDVSA-2013:248)	Nessus	Mandriva Local Security Checks	2013/10/11	2021/1/6	high
75322	openSUSE Security Update : xinetd (openSUSE-SU-2014:0517-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	high

检测

插件搜索

critical

critical

high

high

high

high

high

critical

critical

critical

high

high

high