PT-2007-5333 · Linux Nfs+1 · Nfsidmap+1

Published 2007-09-05 · Updated 2017-09-29 · CVE-2007-4135

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Medium

Base vector

AV:L/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions nfsidmap versions prior to 0.17

Description The issue arises from the NFSv4 ID mapper (nfsidmap) not properly handling return values from the getpwnam r function during username lookup. This can lead to incorrect file ownership reporting, where a file is reported as being owned by "root" instead of "nobody" if the file exists on the server but not on the client.

Recommendations For versions prior to 0.17, update to version 0.17 or later to resolve the issue.

Fix

Related Identifiers

CVE-2007-4135

RHSA-2007:0951

RHSA-2007_0951

Affected Products

Red Hat

Nfsidmap

References · 19

• http://secunia.com/advisories/26674 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-4135 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09590 · Security Note
• http://novell.com/linux/security/advisories/2007_18_sr.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-0951.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-4135 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-4135 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07450 · Security Note
• https://bdu.fstec.ru/vul/2015-07449 · Security Note
• http://secunia.com/advisories/27043 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2007:240 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-4135 · Security Note
• http://osvdb.org/45825 · Note
• https://access.redhat.com/security/cve/CVE-2007-3999 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9864 · Note