[ GLSA 201611-06 ] xinetd

[GLSA]

Gentoo Linux Security Advisory

Title: xinetd: Privilege escalation (GLSA 201611-06)
Severity: normal
Exploitable: remote
Date: November 15, 2016
Bug(s): #488158
ID: 201611-06

Synopsis

A vulnerability in xinetd could lead to privilege escalation.

Background

xinetd is a secure replacement for inetd.

Affected Packages

Package: sys-apps/xinetd
Vulnerable: < 2.3.15-r2
Unaffected: >= 2.3.15-r2
Architectures: All supported architectures


Description

Xinetd does not enforce the user and group configuration directives for
TCPMUX services, which causes these services to be run as root.


Impact

Attackers could escalate privileges outside of the running process.

Workaround

There is no known workaround at this time.

Resolution

All xinetd users should upgrade to the latest version: