[Fwd: [RHSA-2002:196-09] Updated xinetd packages fix denial of service vulnerability]

[Dan Rowles <d.rowles () outcometechnologies com>]

On October 15th, Redhat sent a post to BugTraq advising users of Xinetd
to upgrade to 2.3.9-0.xx

Their latest post (3rd December) advises people to "upgrade" to
2.3.7-4.xx

Can anyone from RedHat please comment on what people who have already
got 2.3.9 installed should do from here? Do we need to force a
downgrade, or is 2.3.9 OK? If so, why the second update, and why has the
2.3.9 RPM disappeared from the mirrors?????

-- 
Dan Rowles
CTO
Outcome Technologies

_________________________________

t: +44 (0)207 656 2460
f: +44 (0)709 230 6588
m: +44 (0)798 076 8143
e: rowlesd () outcometechnologies com
w: http://www.outcometechnologies.com
BUPA House
15-19 Bloomsbury Way
London WC1A 2BA
_________________________________

***This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they are
addressed. If you receive this message in error, please return it to the
sender.*** 
> --- Begin Message ---
>
>
> From: bugzilla () redhat com
>
> Date: Tue, 15 Oct 2002 13:09 -0400
>
> ---------------------------------------------------------------------
>                    Red Hat, Inc. Red Hat Security Advisory
>
> Synopsis:          Updated xinetd packages fix denial of service vulnerability
> Advisory ID:       RHSA-2002:196-09
> Issue date:        2002-09-06
> Updated on:        2002-10-14
> Product:           Red Hat Linux
> Keywords:          xinetd file descriptor leak
> Cross references:  
> Obsoletes:         
> CVE Names:         CAN-2002-0871
> ---------------------------------------------------------------------
>
> 1. Topic:
>
> Xinetd contains a denial-of-service (DoS) vulnerability.
>
> 2. Relevant releases/architectures:
>
> Red Hat Linux 7.0 - alpha, i386
> Red Hat Linux 7.1 - alpha, i386, ia64
> Red Hat Linux 7.2 - i386, ia64
> Red Hat Linux 7.3 - i386
>
> 3. Problem description:
>
> Xinetd is a secure replacement for inetd, the Internet services daemon.
>
> Versions 2.3.4 through 2.3.7 of Xinetd leak file descriptors for the signal
> pipe to services that are launched by xinetd. This could allow an attacker
> to execute a DoS attack via the pipe.
>
> Red Hat Linux 7.3 shipped with xinetd version 2.3.4 and is therefore
> vulnerable to this issue.  All users are advised to upgrade to the errata
> packages containing xinetd version 2.3.9 which is not vulnerable to this issue.
>
> This issue was discovered by Solar Designer.
>
> 4. Solution:
>
> Before applying this update, make sure all previously released errata
> relevant to your system have been applied.
>
> To update all RPMs for your particular architecture, run:
>
> rpm -Fvh [filenames]
>
> where [filenames] is a list of the RPMs you wish to upgrade.  Only those
> RPMs which are currently installed will be updated.  Those RPMs which are
> not installed but included in the list will not be updated.  Note that you
> can also use wildcards (*.rpm) if your current directory *only* contains the
> desired RPMs.
>
> Please note that this update is also available via Red Hat Network.  Many
> people find this an easier way to apply updates.  To use Red Hat Network,
> launch the Red Hat Update Agent with the following command:
>
> up2date
>
> This will start an interactive process that will result in the appropriate
> RPMs being upgraded on your system.
>
> 5. RPMs required:
>
> Red Hat Linux 7.0:
>
> SRPMS:
> ftp://updates.redhat.com/7.0/en/os/SRPMS/xinetd-2.3.9-0.70.src.rpm
>
> alpha:
> ftp://updates.redhat.com/7.0/en/os/alpha/xinetd-2.3.9-0.70.alpha.rpm
>
> i386:
> ftp://updates.redhat.com/7.0/en/os/i386/xinetd-2.3.9-0.70.i386.rpm
>
> Red Hat Linux 7.1:
>
> SRPMS:
> ftp://updates.redhat.com/7.1/en/os/SRPMS/xinetd-2.3.9-0.71.src.rpm
>
> alpha:
> ftp://updates.redhat.com/7.1/en/os/alpha/xinetd-2.3.9-0.71.alpha.rpm
>
> i386:
> ftp://updates.redhat.com/7.1/en/os/i386/xinetd-2.3.9-0.71.i386.rpm
>
> ia64:
> ftp://updates.redhat.com/7.1/en/os/ia64/xinetd-2.3.9-0.71.ia64.rpm
>
> Red Hat Linux 7.2:
>
> SRPMS:
> ftp://updates.redhat.com/7.2/en/os/SRPMS/xinetd-2.3.9-0.72.src.rpm
>
> i386:
> ftp://updates.redhat.com/7.2/en/os/i386/xinetd-2.3.9-0.72.i386.rpm
>
> ia64:
> ftp://updates.redhat.com/7.2/en/os/ia64/xinetd-2.3.9-0.72.ia64.rpm
>
> Red Hat Linux 7.3:
>
> SRPMS:
> ftp://updates.redhat.com/7.3/en/os/SRPMS/xinetd-2.3.9-0.73.src.rpm
>
> i386:
> ftp://updates.redhat.com/7.3/en/os/i386/xinetd-2.3.9-0.73.i386.rpm
>
>
>
> 6. Verification:
>
> MD5 sum                          Package Name
> --------------------------------------------------------------------------
> 8c6ac9eda0398dcd94bca0381ac03026 7.0/en/os/SRPMS/xinetd-2.3.9-0.70.src.rpm
> eba55ee2c7f1008f216a520044ccb15d 7.0/en/os/alpha/xinetd-2.3.9-0.70.alpha.rpm
> 68c73e5047b4038147cc93db1d2a3585 7.0/en/os/i386/xinetd-2.3.9-0.70.i386.rpm
> 621d5914e49a9ad6b61fc185c194de62 7.1/en/os/SRPMS/xinetd-2.3.9-0.71.src.rpm
> 36b905178ce4485f17a5bf5851f4f867 7.1/en/os/alpha/xinetd-2.3.9-0.71.alpha.rpm
> c8b4f5b662351972f1502c929154925c 7.1/en/os/i386/xinetd-2.3.9-0.71.i386.rpm
> e26bdae93d1adcb72bb73c5e9d79d3f0 7.1/en/os/ia64/xinetd-2.3.9-0.71.ia64.rpm
> a3e5cbc60ca4ca0c5396d77e179adef5 7.2/en/os/SRPMS/xinetd-2.3.9-0.72.src.rpm
> f1bc1eefa580f873011821d0b50da5d6 7.2/en/os/i386/xinetd-2.3.9-0.72.i386.rpm
> 3051f3f4b9b6df880e3e8bc101fa36b9 7.2/en/os/ia64/xinetd-2.3.9-0.72.ia64.rpm
> a791cd356503d853ca867f3e73f1080a 7.3/en/os/SRPMS/xinetd-2.3.9-0.73.src.rpm
> ef5508fb220839e60e21840a565972cc 7.3/en/os/i386/xinetd-2.3.9-0.73.i386.rpm
>
>
> These packages are GPG signed by Red Hat, Inc. for security.  Our key
> is available at:
>     http://www.redhat.com/about/contact/pgpkey.html
>
> You can verify each package with the following command:
>     rpm --checksig  <filename>
>
> If you only wish to verify that each package has not been corrupted or
> tampered with, examine only the md5sum with the following command:
>     rpm --checksig --nogpg <filename>
>
>
> 7. References:
>
> http://www.xinetd.org/
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0871
>
>
> Copyright(c) 2000, 2001, 2002 Red Hat, Inc.
>
> --- End Message ---
> --- Begin Message ---
>
>
> From: bugzilla () redhat com
>
> Date: Mon, 2 Dec 2002 15:38 -0500
>
> ---------------------------------------------------------------------
>                    Red Hat, Inc. Red Hat Security Advisory
>
> Synopsis:          Updated xinetd packages fix denial of service vulnerability
> Advisory ID:       RHSA-2002:196-19
> Issue date:        2002-09-06
> Updated on:        2002-12-02
> Product:           Red Hat Linux
> Keywords:          xinetd file descriptor leak flaw:dos-release
> Cross references:  
> Obsoletes:         
> CVE Names:         CAN-2002-0871
> ---------------------------------------------------------------------
>
> 1. Topic:
>
> Xinetd contains a denial-of-service (DoS) vulnerability.
>
> UPDATE 2002-12-02: Updated packages are available to fix issues encountered
> with the previous errata packages.
>
> 2. Relevant releases/architectures:
>
> Red Hat Linux 7.0 - i386, alpha
> Red Hat Linux 7.1 - i386, alpha, ia64
> Red Hat Linux 7.2 - i386, ia64
> Red Hat Linux 7.3 - i386
> Red Hat Linux 8.0 - i386
>
> 3. Problem description:
>
> Xinetd is a secure replacement for inetd, the Internet services daemon.
>
> Versions of Xinetd prior to 2.3.7 leak file descriptors for the signal
> pipe to services that are launched by xinetd. This could allow an attacker
> to execute a DoS attack via the pipe. The Common Vulnerabilities and
> Exposures project has assigned the name CAN-2002-0871 to this issue.
>
> Red Hat Linux 7.3 shipped with xinetd version 2.3.4 and is therefore
> vulnerable to this issue.  All users are advised to upgrade to the errata
> packages which fix the vulnerability.
>
> Thanks to Solar Designer for discovering this issue.
>
> 4. Solution:
>
> Before applying this update, make sure all previously released errata
> relevant to your system have been applied.
>
> To update all RPMs for your particular architecture, run:
>
> rpm -Fvh [filenames]
>
> where [filenames] is a list of the RPMs you wish to upgrade.  Only those
> RPMs which are currently installed will be updated.  Those RPMs which are
> not installed but included in the list will not be updated.  Note that you
> can also use wildcards (*.rpm) if your current directory *only* contains the
> desired RPMs.
>
> Please note that this update is also available via Red Hat Network.  Many
> people find this an easier way to apply updates.  To use Red Hat Network,
> launch the Red Hat Update Agent with the following command:
>
> up2date
>
> This will start an interactive process that will result in the appropriate
> RPMs being upgraded on your system.
>
> 5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):
>
> 74696 - Broken tcp_wrappers support
> 76146 - xinetd 2.3.9 causes hanging CLOSE_WAIT connections
> 77781 - xinetd stop serving the services because "Too many open files"
>
> 6. RPMs required:
>
> Red Hat Linux 7.0:
>
> SRPMS:
> ftp://updates.redhat.com/7.0/en/os/SRPMS/xinetd-2.3.7-4.7x.src.rpm
>
> alpha:
> ftp://updates.redhat.com/7.0/en/os/alpha/xinetd-2.3.7-4.7x.alpha.rpm
>
> i386:
> ftp://updates.redhat.com/7.0/en/os/i386/xinetd-2.3.7-4.7x.i386.rpm
>
> Red Hat Linux 7.1:
>
> SRPMS:
> ftp://updates.redhat.com/7.1/en/os/SRPMS/xinetd-2.3.7-4.7x.src.rpm
>
> alpha:
> ftp://updates.redhat.com/7.1/en/os/alpha/xinetd-2.3.7-4.7x.alpha.rpm
>
> i386:
> ftp://updates.redhat.com/7.1/en/os/i386/xinetd-2.3.7-4.7x.i386.rpm
>
> ia64:
> ftp://updates.redhat.com/7.1/en/os/ia64/xinetd-2.3.7-4.7x.ia64.rpm
>
> Red Hat Linux 7.2:
>
> SRPMS:
> ftp://updates.redhat.com/7.2/en/os/SRPMS/xinetd-2.3.7-4.7x.src.rpm
>
> i386:
> ftp://updates.redhat.com/7.2/en/os/i386/xinetd-2.3.7-4.7x.i386.rpm
>
> ia64:
> ftp://updates.redhat.com/7.2/en/os/ia64/xinetd-2.3.7-4.7x.ia64.rpm
>
> Red Hat Linux 7.3:
>
> SRPMS:
> ftp://updates.redhat.com/7.3/en/os/SRPMS/xinetd-2.3.7-4.7x.src.rpm
>
> i386:
> ftp://updates.redhat.com/7.3/en/os/i386/xinetd-2.3.7-4.7x.i386.rpm
>
> Red Hat Linux 8.0:
>
> SRPMS:
> ftp://updates.redhat.com/8.0/en/os/SRPMS/xinetd-2.3.7-5.src.rpm
>
> i386:
> ftp://updates.redhat.com/8.0/en/os/i386/xinetd-2.3.7-5.i386.rpm
>
>
>
> 7. Verification:
>
> MD5 sum                          Package Name
> --------------------------------------------------------------------------
> 38b5f218a384a7ba7cdc0168e2d5f892 7.0/en/os/SRPMS/xinetd-2.3.7-4.7x.src.rpm
> ee9c54046762e1b3aa53d66da927f9ce 7.0/en/os/alpha/xinetd-2.3.7-4.7x.alpha.rpm
> b4d37fb0fda2fa6606befda4cbd7d458 7.0/en/os/i386/xinetd-2.3.7-4.7x.i386.rpm
> 38b5f218a384a7ba7cdc0168e2d5f892 7.1/en/os/SRPMS/xinetd-2.3.7-4.7x.src.rpm
> ee9c54046762e1b3aa53d66da927f9ce 7.1/en/os/alpha/xinetd-2.3.7-4.7x.alpha.rpm
> b4d37fb0fda2fa6606befda4cbd7d458 7.1/en/os/i386/xinetd-2.3.7-4.7x.i386.rpm
> 569ae16839959297a167bf29e1fb5293 7.1/en/os/ia64/xinetd-2.3.7-4.7x.ia64.rpm
> 38b5f218a384a7ba7cdc0168e2d5f892 7.2/en/os/SRPMS/xinetd-2.3.7-4.7x.src.rpm
> b4d37fb0fda2fa6606befda4cbd7d458 7.2/en/os/i386/xinetd-2.3.7-4.7x.i386.rpm
> 569ae16839959297a167bf29e1fb5293 7.2/en/os/ia64/xinetd-2.3.7-4.7x.ia64.rpm
> 38b5f218a384a7ba7cdc0168e2d5f892 7.3/en/os/SRPMS/xinetd-2.3.7-4.7x.src.rpm
> b4d37fb0fda2fa6606befda4cbd7d458 7.3/en/os/i386/xinetd-2.3.7-4.7x.i386.rpm
> 07c7f1cedf7b9a20bad65815765d4ff2 8.0/en/os/SRPMS/xinetd-2.3.7-5.src.rpm
> 26e6f6faec33503f3538a4ac80c82ce2 8.0/en/os/i386/xinetd-2.3.7-5.i386.rpm
>
>
> These packages are GPG signed by Red Hat, Inc. for security.  Our key
> is available at http://www.redhat.com/about/contact/pgpkey.html
>
> You can verify each package with the following command:
>     
>     rpm --checksig -v <filename>
>
> If you only wish to verify that each package has not been corrupted or
> tampered with, examine only the md5sum with the following command:
>     
>     md5sum <filename>
>
>
> 8. References:
>
> http://www.xinetd.org/
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0871
>
> 9. Contact:
>
> The Red Hat security contact is <security () redhat com>.  More contact
> details at http://www.redhat.com/solutions/security/news/contact.html
>
> Copyright(c) 2000, 2001, 2002 Red Hat, Inc.
>
> --- End Message ---