Description
A regression error in tcp-wrappers 7.6.dbs-10 and 7.6.dbs-11 might allow remote attackers to bypass intended access restrictions when a service uses libwrap but does not specify server connection information.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tcp-wrappers | 7.6.dbs-12 | — |
| Debian 13 | tcp-wrappers | 7.6.dbs-12 | — |
| Debian 12 | tcp-wrappers | 7.6.dbs-12 | — |
References
- ubuntu-tcpwrapper-security-bypass(36364) vdb-entry
- 26567 third-party-advisory
- 40140 vdb-entry
- http://bugs.debian.org/405342
- https://launchpad.net/bugs/135332
- USN-507-1 vendor-advisory