Patch xinetd with CVE-2013-4342 fix (#5230)

SPECS/xinetd/CVE-2013-4342.patch

@@ -0,0 +1,27 @@
+From 91e2401a219121eae15244a6b25d2e79c1af5864 Mon Sep 17 00:00:00 2001
+From: Thomas Swan <thomas.swan@gmail.com>
+Date: Wed, 2 Oct 2013 23:17:17 -0500
+Subject: [PATCH] CVE-2013-4342: xinetd: ignores user and group directives for
+ TCPMUX services
+
+Originally reported to Debian in 2005 <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=324678> and rediscovered <https://bugzilla.redhat.com/show_bug.cgi?id=1006100>, xinetd would execute TCPMUX services without dropping privilege to match the service configuration allowing the service to run with same privilege as the xinetd process (root).
+---
+ xinetd/builtins.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/xinetd/builtins.c b/xinetd/builtins.c
+index 3b85579..34a5bac 100644
+--- a/xinetd/builtins.c
++++ b/xinetd/builtins.c
+@@ -617,7 +617,7 @@ static void tcpmux_handler( const struct server *serp )
+    if( SC_IS_INTERNAL( scp ) ) {
+       SC_INTERNAL(scp, nserp);
+    } else {
+-      exec_server(nserp);
++      child_process(nserp);
+    }
+ }
+ 
+-- 
+2.38.1
+

SPECS/xinetd/xinetd.spec

@@ -1,7 +1,7 @@
 Summary:       xinetd -- A better inetd.
 Name:          xinetd
 Version:       2.3.15
-Release:       13%{?dist}
+Release:       14%{?dist}
 License:       BSD
 Group:         System Environment/Daemons
 Vendor:        Microsoft Corporation
@@ -10,6 +10,7 @@ URL:           https://github.com/xinetd-org/xinetd
 #Source0:      https://github.com/xinetd-org/xinetd/archive/%{name}-2-3-15.tar.gz
 Source0:       %{name}-%{version}.tar.gz
 Source1:       xinetd.service
+Patch0:        CVE-2013-4342.patch
 BuildRequires: systemd
 BuildRequires: libtirpc-devel
 Requires:      systemd
@@ -23,7 +24,7 @@ of servers that can be started, and has a configurable defence
 mechanism to protect against port scanners, among other things.
 
 %prep
-%setup -q
+%autosetup -p1 
 
 %build
 %configure \
@@ -68,6 +69,9 @@ echo "disable xinetd.service" > %{buildroot}%{_libdir}/systemd/system-preset/50-
 %{_libdir}/systemd/system-preset/50-xinetd.preset
 
 %changelog
+* Wed Apr 05 2023 Suresh Thelkar <sthelkar@microsoft.com> - 2.3.15-14
+- Patch CVE-2013-4342
+
 * Thu Dec 16 2021 Pawel Winogrodzki <pawelwi@microsoft.com> - 2.3.15-13
 - Removing the explicit %%clean stage.
 - License verified.