A vulnerability has been identified in Xinetd, which can be exploited by malicious people to cause a DoS (Denial of Service) on a vulnerable system.

The vulnerability is caused due to an error in the function "svc_request" when connection attempts to some services are rejected. The problem is that the allocated memory is not always free'd, which results in a memory leak of 144 bytes each time a connection attempt is rejected.

This can be exploited by a malicious person to consume all available memory on a vulnerable server by trying to connect multiple times to a service configured to be run via xinetd.

Successful exploitation requires that the file "xinetd.conf" includes statements that would cause a connection to be rejected.

Solution
Update to version 2.3.11:
Further details available in Customer Area

Provided and/or discovered by
Steve Grubb

Original Advisory
http://www.xinetd.org/#changes

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area