Skip to content
OpenAdvisories
Unscored CVE-2023-40303 EUVD-2023-44895GHSA-w2mw-45j6-m2cq

GNU inetutils before 2.5 may allow privilege escalation because of unchecked return values of set*id() family functions in ftpd, rcp, rlogi…

Published Aug 14, 2023 · Updated Aug 2, 2024 · Assigned by mitre

Package: inetutils Package: inetutils Ecosystem: Debian Ecosystem: Ubuntu

Description

GNU inetutils before 2.5 may allow privilege escalation because of unchecked return values of set*id() family functions in ftpd, rcp, rlogin, rsh, rshd, and uucpd. This is, for example, relevant if the setuid system call fails when a process is trying to drop privileges before letting an ordinary user control the activities of the process.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 inetutils 2:2.4-3 —
Debian 13 inetutils 2:2.4-3 —
Debian 12 inetutils 2:2.4-2+deb12u1 —
Debian 10 inetutils 2:1.9.4-7+deb10u3 DLA-3611-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS inetutils 2:2.4-3ubuntu1 —
Ubuntu 22.04 LTS inetutils 2:2.2-2ubuntu0.1 USN-6304-1
Ubuntu 20.04 LTS inetutils 2:1.9.4-11ubuntu0.2 USN-6304-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS inetutils 2:1.9.4-3ubuntu0.1+esm2 USN-7781-1
Ubuntu Pro 16.04 LTS inetutils 2:1.9.4-1ubuntu0.1~esm3 USN-7781-1
Ubuntu Pro 14.04 LTS inetutils 2:1.9.2-1ubuntu0.1~esm2 USN-7781-1

Advisories 3

References