COMMAND

	xinetd local and remote vulnerabilities

SYSTEMS AFFECTED

	 All versions of xinetd prior to 2.3.1 

	 DoS in 2.3.4

PROBLEM

	In   EnGarde   Secure   Linux    Security    Advisory    ESA-20011019-03
	(http://www.engardelinux.org/) :
	

	Solar Designer did an audit of xinetd 2.3.0 and came up with a  list  of
	potential vulnerabilities. This release fixes all known  vulnerabilities
	as a precautionary measure. Most of these fixes are in the  interest  of
	robustness and are not known to be exploitable at this time.
	

	For more information on the results of this audit please  refer  to  the
	AUDIT file in the xinetd-2.3.3.tar.gz tarball (included with the  source
	package).
	

	 Update (14 August 2002)

	 ======

	

	Martin    Schulze    in    a    Debian    Security     advisory     [DSA
	151-1][http://www.debian.org/security/] informs us :
	 

	Solar Designer found a vulnerability in xinetd, a  replacement  for  the
	BSD derived inetd. File descriptors for the signal  pipe  introduced  in
	version  2.3.4  are  leaked  into  services  started  from  xinetd.  The
	descriptors could be used to talk to xinetd  resulting  in  crashing  it
	entirely. This is usually called a denial of service.

SOLUTION

	Upgrade :
	

	This [the more recent  DoS]  problem  has  been  fixed  by  the  package
	maintainer in version 2.3.4-1.2  for  the  current  stable  distribution
	(woody) and in version 2.3.7-1 for the unstable distribution (sid).  The
	old stable distribution (potato)  is  not  affected,  since  it  doesn't
	contain the signal pipe.