CVE-2013-1841 Auth bypass in n/a
Remote attackers can bypass ACL restrictions in Net-Server when reverse-lookups are enabled by spoofing hostnames, requiring a patch to fix.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-1841?
CVE-2013-1841 is a medium-severity authentication bypass vulnerability in n/a, published on 13 Jun 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Net-Server, when the reverse-lookups option is enabled, does not check if the hostname resolves to the source IP address, which might allow remote attackers to bypass ACL restrictions via the hostname parameter.
Weakness: CWE-264
Which versions are affected by CVE-2013-1841?
It affects 1 product.
Linux distribution packages (5)
perl-Net-Server SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 2.009-150000.3.3.1 |
perl-Net-Server SUSE:Linux Enterprise Real Time 15 SP3 | All versions | 2.009-150000.3.3.1 |
perl-Net-Server SUSE:Linux Enterprise Server 12 SP5 | All versions | 2.007-5.3.1 |
perl-Net-Server SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 2.007-5.3.1 |
perl-Net-Server openSUSE:Leap 15.4 | All versions | 2.009-150000.3.3.1 |
Products include Seamons Net-Server.
How do I fix CVE-2013-1841?
Apply the vendor's patch.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2013-1841 being exploited?
There is no known exploitation of CVE-2013-1841 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2013-1841, GHSA-7whr-c582-hxj6, MGASA-2023-0120, SUSE-SU-2023:0746-1, SUSE-SU-2023:0759-1, UBUNTU-CVE-2013-1841.