Unchecked return value in Inetutils - GNU network utilities - CVE-2023-40303

Vulnerability identifier: #VU79879

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-40303

CWE-ID: CWE-252

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to usage of an unchecked return values of set*id() family functions in ftpd, rcp, rlogin, rsh, rshd, and uucpd while the setuid system call fails when a process is trying to drop privileges before letting an ordinary user control the activities of the process. A local user can abuse this situation and execute arbitrary code with elevated privileges.

Inetutils - GNU network utilities
Ubuntu
inetutils-talk (Ubuntu package)
inetutils-syslogd (Ubuntu package)
inetutils-telnet (Ubuntu package)
inetutils-ping (Ubuntu package)
inetutils-inetd (Ubuntu package)
inetutils-tools (Ubuntu package)
inetutils-ftpd (Ubuntu package)
inetutils-traceroute (Ubuntu package)
inetutils-ftp (Ubuntu package)
inetutils-telnetd (Ubuntu package)

Install updates from vendor's website.

inetutils-talk (Ubuntu package) - addressed in versions 2:1.9.2-1ubuntu0.1~esm2, 2:1.9.4-1ubuntu0.1~esm3, 2:1.9.4-3ubuntu0.1+esm2
inetutils-syslogd (Ubuntu package) - addressed in versions 2:1.9.2-1ubuntu0.1~esm2, 2:1.9.4-1ubuntu0.1~esm3, 2:1.9.4-3ubuntu0.1+esm2
inetutils-telnet (Ubuntu package) - addressed in versions 2:1.9.2-1ubuntu0.1~esm2, 2:1.9.4-1ubuntu0.1~esm3, 2:1.9.4-3ubuntu0.1+esm2
inetutils-ping (Ubuntu package) - addressed in versions 2:1.9.2-1ubuntu0.1~esm2, 2:1.9.4-1ubuntu0.1~esm3, 2:1.9.4-3ubuntu0.1+esm2
inetutils-inetd (Ubuntu package) - addressed in versions 2:1.9.2-1ubuntu0.1~esm2, 2:1.9.4-1ubuntu0.1~esm3, 2:1.9.4-3ubuntu0.1+esm2
inetutils-tools (Ubuntu package) - addressed in versions 2:1.9.2-1ubuntu0.1~esm2, 2:1.9.4-1ubuntu0.1~esm3, 2:1.9.4-3ubuntu0.1+esm2, 2:1.9.4-11ubuntu0.2, 2:2.2-2ubuntu0.1, 2:2.4-2ubuntu1.1
inetutils-ftpd (Ubuntu package) - addressed in versions 2:1.9.2-1ubuntu0.1~esm2, 2:1.9.4-1ubuntu0.1~esm3, 2:1.9.4-3ubuntu0.1+esm2
inetutils-traceroute (Ubuntu package) - addressed in versions 2:1.9.2-1ubuntu0.1~esm2, 2:1.9.4-1ubuntu0.1~esm3, 2:1.9.4-3ubuntu0.1+esm2
inetutils-ftp (Ubuntu package) - addressed in versions 2:1.9.2-1ubuntu0.1~esm2, 2:1.9.4-1ubuntu0.1~esm3, 2:1.9.4-3ubuntu0.1+esm2
inetutils-telnetd (Ubuntu package) - addressed in versions 2:1.9.4-11ubuntu0.2, 2:2.2-2ubuntu0.1, 2:2.4-2ubuntu1.1

• https://lists.gnu.org/archive/html/bug-inetutils/2023-07/msg00000.html
• https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=e4e65c03f4c11292a3e40ef72ca3f194c8bffdd6

• Privilege escalation in GNU inetutils
• Ubuntu update for inetutils
• Ubuntu update for inetutils