Read the docs
TI-2012-02946 Aliases CVE-2012-3417GHSA-4p8f-j9gj-x3p7

The good_client function in rquotad (rquota_svc.c) in Linux DiskQuota (aka quota) before…

Priority LOW 25CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
Partial · Partial · None
Fix status
Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-264.

Summary

The good_client function in rquotad (rquota_svc.c) in Linux DiskQuota (aka quota) before 3.17 invokes the hosts_ctl function the first time without a host name, which might allow remote attackers to bypass TCP Wrappers rules in hosts.deny.

Why it matters now

EPSS 0.03147 88th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 2 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 25

CPEVersionsRoleVendor
cpe:2.3:a:jan_kara:linux_diskquota:*:*:*:*:*:*:*:*up to 3.16VulnerableJan Kara
cpe:2.3:a:jan_kara:linux_diskquota:2.0:*:*:*:*:*:*:*2.0VulnerableJan Kara
cpe:2.3:a:jan_kara:linux_diskquota:3.01:*:*:*:*:*:*:*3.01VulnerableJan Kara
cpe:2.3:a:jan_kara:linux_diskquota:3.01:pre2:*:*:*:*:*:*3.01 pre2VulnerableJan Kara
cpe:2.3:a:jan_kara:linux_diskquota:3.01:pre3:*:*:*:*:*:*3.01 pre3VulnerableJan Kara
cpe:2.3:a:jan_kara:linux_diskquota:3.01:pre4:*:*:*:*:*:*3.01 pre4VulnerableJan Kara
cpe:2.3:a:jan_kara:linux_diskquota:3.01:pre5:*:*:*:*:*:*3.01 pre5VulnerableJan Kara
cpe:2.3:a:jan_kara:linux_diskquota:3.01:pre6:*:*:*:*:*:*3.01 pre6VulnerableJan Kara
cpe:2.3:a:jan_kara:linux_diskquota:3.01:pre7:*:*:*:*:*:*3.01 pre7VulnerableJan Kara
cpe:2.3:a:jan_kara:linux_diskquota:3.01:pre8:*:*:*:*:*:*3.01 pre8VulnerableJan Kara
  • cpe:2.3:a:jan_kara:linux_diskquota:*:*:*:*:*:*:*:* Versions up to 3.16 Vulnerable ·Jan Kara
  • cpe:2.3:a:jan_kara:linux_diskquota:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Jan Kara
  • cpe:2.3:a:jan_kara:linux_diskquota:3.01:*:*:*:*:*:*:* Versions 3.01 Vulnerable ·Jan Kara
  • cpe:2.3:a:jan_kara:linux_diskquota:3.01:pre2:*:*:*:*:*:* Versions 3.01 pre2 Vulnerable ·Jan Kara
  • cpe:2.3:a:jan_kara:linux_diskquota:3.01:pre3:*:*:*:*:*:* Versions 3.01 pre3 Vulnerable ·Jan Kara
  • cpe:2.3:a:jan_kara:linux_diskquota:3.01:pre4:*:*:*:*:*:* Versions 3.01 pre4 Vulnerable ·Jan Kara
  • cpe:2.3:a:jan_kara:linux_diskquota:3.01:pre5:*:*:*:*:*:* Versions 3.01 pre5 Vulnerable ·Jan Kara
  • cpe:2.3:a:jan_kara:linux_diskquota:3.01:pre6:*:*:*:*:*:* Versions 3.01 pre6 Vulnerable ·Jan Kara
  • cpe:2.3:a:jan_kara:linux_diskquota:3.01:pre7:*:*:*:*:*:* Versions 3.01 pre7 Vulnerable ·Jan Kara
  • cpe:2.3:a:jan_kara:linux_diskquota:3.01:pre8:*:*:*:*:*:* Versions 3.01 pre8 Vulnerable ·Jan Kara
Show 15 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:jan_kara:linux_diskquota:3.01:pre9:*:*:*:*:*:*3.01 pre9VulnerableJan Kara
cpe:2.3:a:jan_kara:linux_diskquota:3.02:*:*:*:*:*:*:*3.02VulnerableJan Kara
cpe:2.3:a:jan_kara:linux_diskquota:3.03:*:*:*:*:*:*:*3.03VulnerableJan Kara
cpe:2.3:a:jan_kara:linux_diskquota:3.04:*:*:*:*:*:*:*3.04VulnerableJan Kara
cpe:2.3:a:jan_kara:linux_diskquota:3.05:*:*:*:*:*:*:*3.05VulnerableJan Kara
cpe:2.3:a:jan_kara:linux_diskquota:3.06:*:*:*:*:*:*:*3.06VulnerableJan Kara
cpe:2.3:a:jan_kara:linux_diskquota:3.07:*:*:*:*:*:*:*3.07VulnerableJan Kara
cpe:2.3:a:jan_kara:linux_diskquota:3.08:*:*:*:*:*:*:*3.08VulnerableJan Kara
cpe:2.3:a:jan_kara:linux_diskquota:3.09:*:*:*:*:*:*:*3.09VulnerableJan Kara
cpe:2.3:a:jan_kara:linux_diskquota:3.10:*:*:*:*:*:*:*3.10VulnerableJan Kara
cpe:2.3:a:jan_kara:linux_diskquota:3.11:*:*:*:*:*:*:*3.11VulnerableJan Kara
cpe:2.3:a:jan_kara:linux_diskquota:3.12:*:*:*:*:*:*:*3.12VulnerableJan Kara
cpe:2.3:a:jan_kara:linux_diskquota:3.13:*:*:*:*:*:*:*3.13VulnerableJan Kara
cpe:2.3:a:jan_kara:linux_diskquota:3.14:*:*:*:*:*:*:*3.14VulnerableJan Kara
cpe:2.3:a:jan_kara:linux_diskquota:3.15:*:*:*:*:*:*:*3.15VulnerableJan Kara
  • cpe:2.3:a:jan_kara:linux_diskquota:3.01:pre9:*:*:*:*:*:* Versions 3.01 pre9 Vulnerable ·Jan Kara
  • cpe:2.3:a:jan_kara:linux_diskquota:3.02:*:*:*:*:*:*:* Versions 3.02 Vulnerable ·Jan Kara
  • cpe:2.3:a:jan_kara:linux_diskquota:3.03:*:*:*:*:*:*:* Versions 3.03 Vulnerable ·Jan Kara
  • cpe:2.3:a:jan_kara:linux_diskquota:3.04:*:*:*:*:*:*:* Versions 3.04 Vulnerable ·Jan Kara
  • cpe:2.3:a:jan_kara:linux_diskquota:3.05:*:*:*:*:*:*:* Versions 3.05 Vulnerable ·Jan Kara
  • cpe:2.3:a:jan_kara:linux_diskquota:3.06:*:*:*:*:*:*:* Versions 3.06 Vulnerable ·Jan Kara
  • cpe:2.3:a:jan_kara:linux_diskquota:3.07:*:*:*:*:*:*:* Versions 3.07 Vulnerable ·Jan Kara
  • cpe:2.3:a:jan_kara:linux_diskquota:3.08:*:*:*:*:*:*:* Versions 3.08 Vulnerable ·Jan Kara
  • cpe:2.3:a:jan_kara:linux_diskquota:3.09:*:*:*:*:*:*:* Versions 3.09 Vulnerable ·Jan Kara
  • cpe:2.3:a:jan_kara:linux_diskquota:3.10:*:*:*:*:*:*:* Versions 3.10 Vulnerable ·Jan Kara
  • cpe:2.3:a:jan_kara:linux_diskquota:3.11:*:*:*:*:*:*:* Versions 3.11 Vulnerable ·Jan Kara
  • cpe:2.3:a:jan_kara:linux_diskquota:3.12:*:*:*:*:*:*:* Versions 3.12 Vulnerable ·Jan Kara
  • cpe:2.3:a:jan_kara:linux_diskquota:3.13:*:*:*:*:*:*:* Versions 3.13 Vulnerable ·Jan Kara
  • cpe:2.3:a:jan_kara:linux_diskquota:3.14:*:*:*:*:*:*:* Versions 3.14 Vulnerable ·Jan Kara
  • cpe:2.3:a:jan_kara:linux_diskquota:3.15:*:*:*:*:*:*:* Versions 3.15 Vulnerable ·Jan Kara

Remediation

Red Hat 1 advisory

  • RHSA-2013:0120 Released 2013-01-08 · Red Hat rating Low
    quota security and bug fix update
    • Red Hat Enterprise Linux (v. 5 server) quota-1:3.13-8.el5, quota-1:3.13-8.el5.i386, quota-1:3.13-8.el5.ia64 +1
    • Red Hat Enterprise Linux Desktop (v. 5 client) quota-1:3.13-8.el5, quota-1:3.13-8.el5.i386

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 4AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2013:0120
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2013:0120

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-3417
  2. 2026-10-03 Alias added: GHSA-4p8f-j9gj-x3p7

References

Advisory 2

Other 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences