Description
The good_client function in rquotad (rquota_svc.c) in Linux DiskQuota (aka quota) before 3.17 invokes the hosts_ctl function the first time without a host name, which might allow remote attackers to bypass TCP Wrappers rules in hosts.deny.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://hermes.opensuse.org/messages/15509723 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=566717 ↗
- http://www.openwall.com/lists/oss-security/2012/07/19/2 ↗
- http://rhn.redhat.com/errata/RHSA-2013-0120.html ↗
- http://www.openwall.com/lists/oss-security/2012/07/19/5 ↗
- http://linuxquota.git.sourceforge.net/git/gitweb.cgi?p=linuxquota/linuxquota%3Ba=commitdiff%3Bh=0abbfe92536fa5854eb65572de0cf131f80e2387 ↗
- http://sourceforge.net/tracker/?func=detail&aid=2743481&group_id=18136&atid=118136 ↗
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 ↗