xinetd 2.1.8 and earlier runs with a default umask of 0, which could allow local users to…
Priority LOW 17Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · Partial · None
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.
Summary
xinetd 2.1.8 and earlier runs with a default umask of 0, which could allow local users to read or modify files that are created by an application that runs under xinetd but does not set its own safe umask.
Why it matters now
EPSS 0.00363 30th percentileScored 2026-11-07
Fix Fixed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 16
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:xinetd:xinetd:2.1.8.8:*:*:*:*:*:*:* | 2.1.8.8 | Vulnerable | Xinetd |
| cpe:2.3:a:xinetd:xinetd:2.1.8.8_pre3:*:*:*:*:*:*:* | 2.1.8.8_pre3 | Vulnerable | Xinetd |
| cpe:2.3:a:xinetd:xinetd:2.1.8.9_pre1:*:*:*:*:*:*:* | 2.1.8.9_pre1 | Vulnerable | Xinetd |
| cpe:2.3:a:xinetd:xinetd:2.1.8.9_pre2:*:*:*:*:*:*:* | 2.1.8.9_pre2 | Vulnerable | Xinetd |
| cpe:2.3:a:xinetd:xinetd:2.1.8.9_pre3:*:*:*:*:*:*:* | 2.1.8.9_pre3 | Vulnerable | Xinetd |
| cpe:2.3:a:xinetd:xinetd:2.1.8.9_pre4:*:*:*:*:*:*:* | 2.1.8.9_pre4 | Vulnerable | Xinetd |
| cpe:2.3:a:xinetd:xinetd:2.1.8.9_pre5:*:*:*:*:*:*:* | 2.1.8.9_pre5 | Vulnerable | Xinetd |
| cpe:2.3:a:xinetd:xinetd:2.1.8.9_pre7:*:*:*:*:*:*:* | 2.1.8.9_pre7 | Vulnerable | Xinetd |
| cpe:2.3:a:xinetd:xinetd:2.1.8.9_pre8:*:*:*:*:*:*:* | 2.1.8.9_pre8 | Vulnerable | Xinetd |
| cpe:2.3:a:xinetd:xinetd:2.1.8.9_pre9:*:*:*:*:*:*:* | 2.1.8.9_pre9 | Vulnerable | Xinetd |
- cpe:2.3:a:xinetd:xinetd:2.1.8.8:*:*:*:*:*:*:* Versions 2.1.8.8 Vulnerable ·Xinetd
- cpe:2.3:a:xinetd:xinetd:2.1.8.8_pre3:*:*:*:*:*:*:* Versions 2.1.8.8_pre3 Vulnerable ·Xinetd
- cpe:2.3:a:xinetd:xinetd:2.1.8.9_pre1:*:*:*:*:*:*:* Versions 2.1.8.9_pre1 Vulnerable ·Xinetd
- cpe:2.3:a:xinetd:xinetd:2.1.8.9_pre2:*:*:*:*:*:*:* Versions 2.1.8.9_pre2 Vulnerable ·Xinetd
- cpe:2.3:a:xinetd:xinetd:2.1.8.9_pre3:*:*:*:*:*:*:* Versions 2.1.8.9_pre3 Vulnerable ·Xinetd
- cpe:2.3:a:xinetd:xinetd:2.1.8.9_pre4:*:*:*:*:*:*:* Versions 2.1.8.9_pre4 Vulnerable ·Xinetd
- cpe:2.3:a:xinetd:xinetd:2.1.8.9_pre5:*:*:*:*:*:*:* Versions 2.1.8.9_pre5 Vulnerable ·Xinetd
- cpe:2.3:a:xinetd:xinetd:2.1.8.9_pre7:*:*:*:*:*:*:* Versions 2.1.8.9_pre7 Vulnerable ·Xinetd
- cpe:2.3:a:xinetd:xinetd:2.1.8.9_pre8:*:*:*:*:*:*:* Versions 2.1.8.9_pre8 Vulnerable ·Xinetd
- cpe:2.3:a:xinetd:xinetd:2.1.8.9_pre9:*:*:*:*:*:*:* Versions 2.1.8.9_pre9 Vulnerable ·Xinetd
Show 6 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:xinetd:xinetd:2.1.8.9_pre10:*:*:*:*:*:*:* | 2.1.8.9_pre10 | Vulnerable | Xinetd |
| cpe:2.3:a:xinetd:xinetd:2.1.8.9_pre11:*:*:*:*:*:*:* | 2.1.8.9_pre11 | Vulnerable | Xinetd |
| cpe:2.3:a:xinetd:xinetd:2.1.8.9_pre12:*:*:*:*:*:*:* | 2.1.8.9_pre12 | Vulnerable | Xinetd |
| cpe:2.3:a:xinetd:xinetd:2.1.8.9_pre13:*:*:*:*:*:*:* | 2.1.8.9_pre13 | Vulnerable | Xinetd |
| cpe:2.3:a:xinetd:xinetd:2.1.8.9_pre14:*:*:*:*:*:*:* | 2.1.8.9_pre14 | Vulnerable | Xinetd |
| cpe:2.3:a:xinetd:xinetd:2.1.8.9_pre15:*:*:*:*:*:*:* | 2.1.8.9_pre15 | Vulnerable | Xinetd |
- cpe:2.3:a:xinetd:xinetd:2.1.8.9_pre10:*:*:*:*:*:*:* Versions 2.1.8.9_pre10 Vulnerable ·Xinetd
- cpe:2.3:a:xinetd:xinetd:2.1.8.9_pre11:*:*:*:*:*:*:* Versions 2.1.8.9_pre11 Vulnerable ·Xinetd
- cpe:2.3:a:xinetd:xinetd:2.1.8.9_pre12:*:*:*:*:*:*:* Versions 2.1.8.9_pre12 Vulnerable ·Xinetd
- cpe:2.3:a:xinetd:xinetd:2.1.8.9_pre13:*:*:*:*:*:*:* Versions 2.1.8.9_pre13 Vulnerable ·Xinetd
- cpe:2.3:a:xinetd:xinetd:2.1.8.9_pre14:*:*:*:*:*:*:* Versions 2.1.8.9_pre14 Vulnerable ·Xinetd
- cpe:2.3:a:xinetd:xinetd:2.1.8.9_pre15:*:*:*:*:*:*:* Versions 2.1.8.9_pre15 Vulnerable ·Xinetd
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Linux 7.0 | Fixed | RHSA-2001:075 |
| Red Hat Linux 7.1 | Fixed | RHSA-2001:075 |
Timeline
- 2026-10-02 Threatist record created from CVE-2001-1322
- 2026-10-03 Alias added: GHSA-5m73-qfh8-jmx3
References
More Xinetd vulnerabilities
- TI-2001-00788 Buffer overflow in internal string handling routines of xinetd before 2.1.8.8 allows… CVSS 2.0HIGH 10.0
- TI-2013-03803 xinetd does not enforce the user and group configuration directives for TCPMUX services… CVSS 2.0HIGH 7.6
- TI-2001-01341 Multiple vulnerabilities in xinetd 2.3.0 and earlier, and additional variants until… CVSS 2.0HIGH 7.5
- TI-2000-00535 xinetd 2.1.8.x does not properly restrict connections if hostnames are used for access… CVSS 2.0HIGH 7.5
- TI-2003-00195 Memory leak in xinetd 2.3.10 allows remote attackers to cause a denial of service (memory… CVSS 2.0MEDIUM 5.0
- TI-2012-00797 builtins.c in Xinetd before 2.3.15 does not check the service type when the tcpmux-server… CVSS 2.0MEDIUM 4.3
Sources
- CVE-2001-1322 · CVE Program
- CVE-2001-1322 · NVD
- FIRST EPSS
- GHSA-5m73-qfh8-jmx3 · GitHub Advisory Database · CC BY 4.0
- CVE-2001-1322 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences