CVE Feed

    Dashboard / CVE / CVE-2023-40303

    CVE-2023-40303

    GNU inetutils before 2.5 may allow privilege escalation because of unchecked return values of set*id() family functions in ftpd, rcp, rlogin, rsh, rshd, and uucpd. This is, for example, relevant if the setuid system call fails when a process is trying to drop privileges before letting an ordinary user control the activities of the process.

    Published:Aug 14, 2023
    Last Modified:Nov 21, 2024
    EPS:Aug 14, 2023
    EPSS Score:0.00043
    CVSS Score:7.8

    Affected Products

    Vendor
    Gnu
    Product
    Inetutils

    Exploits

    https://lists.gnu.org/archive/html/bug-inetutils/2023-07/msg00000.htmlhttps://lists.gnu.org/archive/html/bug-inetutils/2023-07/msg00000.html

    Common Weakness Enumeration

    CWE-252 Unchecked Return Value

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-32772 (CVSS 3.4) — telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NE…
    CVE-2026-32746 (CVSS 9.8) — telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) …
    CVE-2026-28372 (CVSS 7.4) — telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd serv…
    CVE-2026-24061 (CVSS 9.8) — telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER en…
    CVE-2022-39028 (CVSS 7.5) — telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer der…
    CVE-2021-40491 (CVSS 6.5) — The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make…
    CVE-2011-4862 (CVSS 10) — Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applicati…
    CVE-2004-1485 (CVSS 7.5) — Buffer overflow in the TFTP client in InetUtils 1.4.2 allows remote malicious DNS servers to execute arbitrary…

    References

    http://www.openwall.com/lists/oss-security/2023/12/30/4
    https://ftp.gnu.org/gnu/inetutils/
    https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=e4e65c03f4c11292a3e40ef72ca3f194c8bffdd6
    https://lists.debian.org/debian-lts-announce/2023/10/msg00013.html
    https://lists.debian.org/debian-lts-announce/2023/10/msg00013.html
    https://lists.debian.org/debian-lts-announce/2023/10/msg00013.html
    https://lists.debian.org/debian-lts-announce/2023/10/msg00013.html
    https://lists.gnu.org/archive/html/bug-inetutils/2023-07/msg00000.html
    http://www.openwall.com/lists/oss-security/2023/12/30/4
    https://ftp.gnu.org/gnu/inetutils/
    https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=e4e65c03f4c11292a3e40ef72ca3f194c8bffdd6
    https://lists.debian.org/debian-lts-announce/2023/10/msg00013.html
    https://lists.debian.org/debian-lts-announce/2023/10/msg00013.html
    https://lists.debian.org/debian-lts-announce/2023/10/msg00013.html
    https://lists.debian.org/debian-lts-announce/2023/10/msg00013.html
    https://lists.gnu.org/archive/html/bug-inetutils/2023-07/msg00000.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High