PT-2007-1505 · Red Hat · Red Hat

Publicado 2007-09-18 · Atualizado 2008-09-05 · CVE-2007-0004

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Baixa

Vetor base

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Red Hat Enterprise Linux (RHEL) version 3

Description The issue concerns the NFS client implementation in the kernel. When a filesystem is mounted with the noacl option, it checks permissions for the open system call via vfs permission (mode bits) data rather than an NFS ACCESS call to the server. This allows local client processes to obtain a false success status from open calls that the server would deny, and possibly obtain sensitive information about file permissions on the server.

Recommendations For Red Hat Enterprise Linux (RHEL) version 3, consider mounting filesystems with the acl option instead of noacl to ensure proper permission checks are performed via NFS ACCESS calls to the server. As a temporary workaround, restrict access to sensitive files and directories to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2007-0004

Produtos afetados

Red Hat

Referências · 2

• https://bugzilla.redhat.com/show_bug.cgi?id=199715 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-0004 · Nota de Segurança