PT-2013-5242 · Freebsd · Freebsd

Publicado 2013-07-28 · Atualizado 2019-03-18 · CVE-2013-4851

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions FreeBSD versions 8.3 and 9.x through 9.1-RELEASE-p5

Description The issue concerns the NFS server implementation in the kernel, where the vfs hang addrlist function in sys/kern/vfs export.c controls authorization for host/subnet export entries based on group information sent by the client. This allows remote attackers to bypass file permissions on NFS filesystems via crafted requests.

Recommendations For FreeBSD versions 8.3 and 9.x through 9.1-RELEASE-p5, consider restricting access to the NFS server until a patch is available. As a temporary workaround, restrict the use of the vfs hang addrlist function to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2013-4851

DSA-2743-1

Produtos afetados

Freebsd

Referências · 4

• http://freebsd.org/security/advisories/FreeBSD-SA-13:08.nfsserver.asc · Aviso do Fabricante
• http://svnweb.freebsd.org/base?view=revision&revision=244226 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-4851 · Nota de Segurança
• http://securityfocus.com/bid/61484 · Nota