PT-2008-1106 · Nfs Utils+1 · Nfs-Utils+1

Josh Bressers · Published 2008-10-14 · Updated 2018-10-11 · CVE-2008-4552

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions nfs-utils versions 1.0.9 through 1.1.3

Description The issue concerns a problem in the nfs-utils package that can lead to a breach of confidentiality, integrity, and availability of protected information. This can be exploited remotely. The good client function in nfs-utils invokes the hosts ctl function with the wrong order of arguments, causing TCP Wrappers to ignore netgroups and allowing remote attackers to bypass intended access restrictions.

Recommendations For nfs-utils versions 1.0.9 through 1.1.3, update to version 1.1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the good client function until a patch is available.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-09362

CVE-2008-4552

RHSA-2009:1321

RHSA-2009_1321

Affected Products

Red Hat

Nfs-Utils

References · 28

• http://secunia.com/advisories/32346 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-4552 · Security Note
• http://redhat.com/support/errata/RHSA-2009-1321.html · Vendor Advisory
• http://vupen.com/english/advisories/2010/0528 · Vendor Advisory
• http://securityfocus.com/bid/31823 · Patch
• http://ubuntu.com/usn/USN-687-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:060 · Vendor Advisory
• http://secunia.com/advisories/33006 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-4552 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-4552 · Vendor Advisory
• http://secunia.com/advisories/32481 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-4552 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09362 · Security Note
• http://secunia.com/advisories/38794 · Vendor Advisory
• http://secunia.com/advisories/38833 · Vendor Advisory