Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

FreeBSD TCP Wrappers may let attackers evade access controls

CVE-2001-1155 · published 25 years ago
Summary

FreeBSD versions 4.1.1 through 4.3 using the PARANOID setting can be tricked by forged DNS information, allowing remote users to get past the intended network restrictions. This could let unauthorized connections reach services that should be blocked. Apply the latest patches or upgrade to a newer FreeBSD release that corrects the DNS check.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
freebsd freebsd >= 4.1.1, <= 4.3
cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*
Original advisory text
TCP Wrappers (tcp_wrappers) in FreeBSD 4.1.1 through 4.3 with the PARANOID ACL option enabled does not properly check the result of a reverse DNS lookup, which could allow remote attackers to bypas...
TCP Wrappers (tcp_wrappers) in FreeBSD 4.1.1 through 4.3 with the PARANOID ACL option enabled does not properly check the result of a reverse DNS lookup, which could allow remote attackers to bypass intended access restrictions via DNS spoofing.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-863Incorrect Authorization
Timeline
Published23 Aug 2001
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2001-1155 · NVD
Track software like this
Free during beta