Test Kennung:	1.3.6.1.4.1.25623.1.0.53887
Kategorie:	Slackware Local Security Checks
Titel:	Slackware: Security Advisory (SSA:2003-251-01)
Zusammenfassung:	The remote host is missing an update for the 'inetd' package(s) announced via the SSA:2003-251-01 advisory.
Beschreibung:	Summary: The remote host is missing an update for the 'inetd' package(s) announced via the SSA:2003-251-01 advisory. Vulnerability Insight: Upgraded inetd packages are available for Slackware 8.1, 9.0 and - -current. These fix a previously hard-coded limit of 256 connections-per-minute, after which the given service is disabled for ten minutes. An attacker could use a quick burst of connections every ten minutes to effectively disable a service. Once upon a time, this was an intentional feature of inetd, but in today's world it has become a bug. Even having inetd look at the source IP and try to limit only the source of the attack would be problematic since TCP source addresses are so easily faked. So, the approach we have taken (borrowed from FreeBSD) is to disable this rate limiting 'feature' by default. It can be re-enabled by providing a -R option on the command-line if desired, but for obvious reasons we do not recommend this. Any site running services through inetd that they would like protected from this simple DoS attack should upgrade to the new inetd package immediately. Here are the details from the Slackware 9.0 ChangeLog: +--------------------------+ patches/packages/inetd-1.79s-i386-2.tgz: Disable inetd's (stupid) connection limiting code which can actually cause a DoS rather than preventing it. The default connections-per-minute is now unlimited. -R 0 also removes limiting (this is now mentioned in the man page as well). Thanks to 3APA3A for reporting this issue. (* Security fix *) +--------------------------+ Affected Software/OS: 'inetd' package(s) on Slackware 8.1, Slackware 9.0, Slackware current. Solution: Please install the updated package(s). CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Copyright	Copyright (C) 2012 Greenbone AG

Dies ist nur einer von 145615 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.