CVE-2009-0786
Description
[REJECTED CVE] A flaw was found in the tcp_wrappers related to the handling of hostnames specified in the host access rules in /etc/hosts.allow and /etc/hosts.deny. This issue affects applications like net-snmp snmpd and OpenLDAP daemons that uses the hosts_ctl() tcp_wrappers interface function. The flaw prevents correct matching of access rules with hostnames, potentially leading to incorrectly denied access (if in an allow rule) or bypassed access restrictions (if in a deny rule). Attackers could exploit this to gain unauthorized access or disrupt legitimate connections.
Statement
This CVE has been rejected upstream, because this was originally intended for a report about TCP Wrappers and the hosts_ctl API function, but further investigation showed that this was documented behavior by that function.
Red Hat has also evaluated this issue and determined that it does not meet the criteria to be classified as a security vulnerability. This assessment is based on the issue not posing a significant security risk, being a result of misconfiguration or usage error, or falling outside the scope of security considerations.
As such, this CVE has been marked as "Rejected" in alignment with Red Hat's vulnerability management policies.
If you have additional information or concerns regarding this determination, please contact Red Hat Product Security for further clarification.
Also, please note that this issue was previously fixed as bug (access incorrectly denied) and patches are available in Red Hat Enterprise Linux 5 (RHBA-2007:0565).
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v2 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Access Complexity | High | N/A | N/A |
| Authentication | None | N/A | N/A |
| Confidentiality Impact | Partial | N/A | N/A |
| Integrity Impact | Partial | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: AV:N/AC:H/Au:N/C:P/I:P/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
