{"id":"CVE-2013-4342","aliases":["AZL-13592","AZL-35352","DEBIAN-CVE-2013-4342","EUVD-2013-4228","GHSA-3vj5-whv8-66p9","MGASA-2013-0302","RHSA-2013:1409","UBUNTU-CVE-2013-4342","openSUSE-SU-2024:10323-1"],"status":"published","title":"xinetd does not enforce the user and group configuration directives for TCPMUX services, which...","description":"xinetd does not enforce the user and group configuration directives for TCPMUX services, which causes these services to be run as root and makes it easier for remote attackers to gain privileges by leveraging another vulnerability in a service.","severity":{"version":"2.0","score":7.6,"vector":"AV:N/AC:H/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.06391,"percentile":0.9371,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2013-10-09T22:47:09Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:2","package":"xinetd","fixed_in":["2.3.15-14"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"xinetd","fixed_in":["2.3.15-14"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xinetd","fixed_in":["1:2.3.15-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xinetd","fixed_in":["1:2.3.15-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xinetd","fixed_in":["1:2.3.15-2"],"sources":["osv"]},{"ecosystem":"Mageia:2","package":"xinetd","fixed_in":["2.3.15-1.1.mga2"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"xinetd","fixed_in":["2.3.15-3.1.mga3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"xinetd","fixed_in":["2:2.3.14-20.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"xinetd-debuginfo","fixed_in":["2:2.3.14-20.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"xinetd","fixed_in":["2:2.3.14-20.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"xinetd-debuginfo","fixed_in":["2:2.3.14-20.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"xinetd","fixed_in":["2:2.3.14-39.el6_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"xinetd-debuginfo","fixed_in":["2:2.3.14-39.el6_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"xinetd","fixed_in":["2:2.3.14-39.el6_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"xinetd-debuginfo","fixed_in":["2:2.3.14-39.el6_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"xinetd","fixed_in":["2:2.3.14-39.el6_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"xinetd-debuginfo","fixed_in":["2:2.3.14-39.el6_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xinetd","fixed_in":["2:2.3.14-39.el6_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xinetd-debuginfo","fixed_in":["2:2.3.14-39.el6_4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"xinetd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.15-14"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"xinetd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.15-14"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xinetd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.15-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xinetd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.15-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xinetd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.15-2"}]}]},{"source":"osv","ecosystem":"Mageia:2","package":"xinetd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.15-1.1.mga2"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"xinetd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.15-3.1.mga3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"xinetd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.3.14-20.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"xinetd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.3.14-20.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xinetd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.3.14-20.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xinetd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.3.14-20.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"xinetd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.3.14-39.el6_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"xinetd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.3.14-39.el6_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"xinetd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.3.14-39.el6_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"xinetd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.3.14-39.el6_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"xinetd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.3.14-39.el6_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"xinetd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.3.14-39.el6_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xinetd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.3.14-39.el6_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xinetd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.3.14-39.el6_4"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xinetd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.15-11.3"}]}],"bundled":2}],"products":[{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"xinetd","product":"xinetd"}],"references":[{"url":"https://security.gentoo.org/glsa/201611-06","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1006100","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","evidence","fix","report"]},{"url":"https://github.com/xinetd-org/xinetd/pull/10","tags":["x_refsource_CONFIRM","x_transferred","fix"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1409.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4342","tags":["web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:1409","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4342","tags":["report"]},{"url":"https://github.com/advisories/GHSA-3vj5-whv8-66p9"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-4342","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2013-0302.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=11406","tags":["report"]},{"url":"https://rhn.redhat.com/errata/RHSA-2013-1409.html","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1409.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4342","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2013-4342","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4342","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-4342","description":"xinetd does not enforce the user and group configuration directives for TCPMUX services, which causes these services to be run as root and makes it easier for remote attackers to gain privileges by leveraging another vulnerability in a service.","status":"published","published":"2013-10-10T00:00:00Z","modified":"2024-08-06T16:38:01.956Z","updated_at":"2026-11-02T14:34:57.869657Z"}],"euvd":[{"id":"EUVD-2013-4228","description":"xinetd does not enforce the user and group configuration directives for TCPMUX services, which causes these services to be run as root and makes it easier for remote attackers to gain privileges by leveraging another vulnerability in a service.","status":"published","published":"2013-10-10T00:00:00Z","modified":"2024-08-06T16:38:01Z","updated_at":"2026-11-03T01:56:32.187151Z"}],"ghsa":[{"id":"GHSA-3vj5-whv8-66p9","title":"xinetd does not enforce the user and group configuration directives for TCPMUX services, which...","description":"xinetd does not enforce the user and group configuration directives for TCPMUX services, which causes these services to be run as root and makes it easier for remote attackers to gain privileges by leveraging another vulnerability in a service.","status":"published","published":"2022-05-14T01:08:28Z","modified":"2023-02-02T21:34:12Z","updated_at":"2026-11-02T14:52:47.993176Z"}],"nvd":[{"id":"CVE-2013-4342","description":"xinetd does not enforce the user and group configuration directives for TCPMUX services, which causes these services to be run as root and makes it easier for remote attackers to gain privileges by leveraging another vulnerability in a service.","status":"published","published":"2013-10-10T00:55:14.96Z","modified":"2026-06-16T23:57:03.58Z","cvss":[{"version":"2.0","score":7.6,"vector":"AV:N/AC:H/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:38.715467Z"}],"osv":[{"id":"AZL-13592","title":"CVE-2013-4342 affecting package xinetd for versions less than 2.3.15-14","description":"xinetd does not enforce the user and group configuration directives for TCPMUX services, which causes these services to be run as root and makes it easier for remote attackers to gain privileges by leveraging another vulnerability in a service.","status":"published","published":"2013-10-10T00:55:14Z","modified":"2026-04-21T04:22:55.645807Z","updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"AZL-35352","title":"CVE-2013-4342 affecting package xinetd for versions less than 2.3.15-14","description":"xinetd does not enforce the user and group configuration directives for TCPMUX services, which causes these services to be run as root and makes it easier for remote attackers to gain privileges by leveraging another vulnerability in a service.","status":"published","published":"2013-10-10T00:55:14Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:19.554273Z"},{"id":"CVE-2013-4342","description":"xinetd does not enforce the user and group configuration directives for TCPMUX services, which causes these services to be run as root and makes it easier for remote attackers to gain privileges by leveraging another vulnerability in a service.","status":"published","published":"2013-10-10T00:55:14Z","modified":"2026-04-16T06:20:26.165810101Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-4342","description":"xinetd does not enforce the user and group configuration directives for TCPMUX services, which causes these services to be run as root and makes it easier for remote attackers to gain privileges by leveraging another vulnerability in a service.","status":"published","published":"2013-10-10T00:55:14.96Z","modified":"2026-09-01T20:03:18.126809746Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"MGASA-2013-0302","title":"Updated xinetd package fixes security vulnerability","description":"It was found that xinetd ignored the user and group configuration\ndirectives for services running under the tcpmux-server service. This flaw\ncould cause the associated services to run as root. If there was a flaw in\nsuch a service, a remote attacker could use it to execute arbitrary code\nwith the privileges of the root user (CVE-2013-4342).\n","status":"published","published":"2013-10-09T22:47:09Z","modified":"2026-04-16T06:24:52.364849841Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10323-1","title":"xinetd-2.3.15-11.3 on GA media","description":"These are all security issues fixed in the xinetd-2.3.15-11.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:42:37.625174Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2013:1409","title":"Red Hat Security Advisory: xinetd security update","status":"published","published":"2024-09-15T21:07:01Z","modified":"2026-06-28T10:08:37Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"UBUNTU-CVE-2013-4342","description":"xinetd does not enforce the user and group configuration directives for TCPMUX services, which causes these services to be run as root and makes it easier for remote attackers to gain privileges by leveraging another vulnerability in a service.","status":"withdrawn","published":"2013-10-10T00:55:00Z","modified":"2025-07-16T07:31:21.222982Z","updated_at":"2026-11-02T15:54:07.421078Z"}]}}