Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

Debian 10: DLA-3611-1 Critical: Inetutils Code Execution and Escalation

debian lts
Calendar Grey October 8, 2023
Dist Debian Esm H88
Ubuntu Security Notice USN-3452-1 tackles vulnerabilities in gnome-shell, recommending that users update their systems without delay.
Security issues were discovered in inetutils, a collection of GNU network utilities, which could lead to privilege escalation or potentially execution of arbitrary code
Topics%20covered

Topics Covered

security advisory critical debian execution escalation privilege inetutils

Summary

CVE-2019-0053

Thorsten Alteholz discovered that CVE-2019-0053 was patched
incorrectly in inetutils 2:1.9.4-7+deb10u3. The original
vulnerability remained: inetutils' telnet client doesn't
sufficiently validate environment variables, which can lead to
stack-based buffer overflows. (This issue is limited to local
exploitation from restricted shells.)

CVE-2023-40303

Jeffrey Bencteux discovered that several setuid(), setgid(),
seteuid() and setguid() return values were not checked in ftpd/
rcp/rlogin/rsh/rshd/uucpd code, which may lead to privilege
escalation.

For Debian 10 buster, these problems have been fixed in version
2:1.9.4-7+deb10u3.

We recommend that you upgrade your inetutils packages.

For the detailed security status of inetutils please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/inetutils

Further information about Debian LTS security advisories, how to apply

Read the Full Advisory


Severity
critical
Lowest
Low
Medium
High
Critical

Package: inetutils
Version: 2:1.9.4-7+deb10u3
CVE ID: CVE-2019-0053 CVE-2023-40303
Debian Bug: 945861 1049365

Topics%20covered

Topics Covered

security advisory critical debian execution escalation privilege inetutils

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here