gnu/packages/patches/xinetd-CVE-2013-4342.patch

   1 Fix CVE-2013-4342:
   2
   3 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4342
   4 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=324678
   5
   6 Patch copied from upstream source repository:
   7
   8 https://github.com/xinetd-org/xinetd/commit/91e2401a219121eae15244a6b25d2e79c1af5864
   9
  10 From 91e2401a219121eae15244a6b25d2e79c1af5864 Mon Sep 17 00:00:00 2001
  11 From: Thomas Swan <thomas.swan@gmail.com>
  12 Date: Wed, 2 Oct 2013 23:17:17 -0500
  13 Subject: [PATCH] CVE-2013-4342: xinetd: ignores user and group directives for
  14  TCPMUX services
  15
  16 Originally reported to Debian in 2005 <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=324678> and rediscovered <https://bugzilla.redhat.com/show_bug.cgi?id=1006100>, xinetd would execute TCPMUX services without dropping privilege to match the service configuration allowing the service to run with same privilege as the xinetd process (root).
  17 ---
  18  xinetd/builtins.c | 2 +-
  19  1 file changed, 1 insertion(+), 1 deletion(-)
  20
  21 diff --git a/xinetd/builtins.c b/xinetd/builtins.c
  22 index 3b85579..34a5bac 100644
  23 --- a/xinetd/builtins.c
  24 +++ b/xinetd/builtins.c
  25 @@ -617,7 +617,7 @@ static void tcpmux_handler( const struct server *serp )
  26     if( SC_IS_INTERNAL( scp ) ) {
  27        SC_INTERNAL(scp, nserp);
  28     } else {
  29 -      exec_server(nserp);
  30 +      child_process(nserp);
  31     }
  32  }
  33
  34 --
  35 2.7.4
  36