PT-2017-6667 · Sharenfs · Sharenfs

Ggzengel · Published 2017-10-18 · Updated 2017-11-08 · CVE-2015-3400

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions sharenfs version 0.6.4

Description The issue allows remote authenticated users to potentially obtain sensitive information by reading shared files due to world-readable access to the shared zfs file system.

Recommendations For sharenfs version 0.6.4, consider restricting access to the shared zfs file system to prevent unauthorized reading of sensitive files until a proper fix is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-3400

Affected Products

Sharenfs

References · 6

• https://github.com/zfsonlinux/zfs/pull/2790/commits · Patch
• https://github.com/FransUrbo/zfs/commit/99aa4d2b4fd12c6bef62d02ffd1b375ddd42fcf4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-3400 · Security Note
• https://github.com/zfsonlinux/zfs/issues/3319 · Note
• http://securityfocus.com/bid/74272 · Note
• http://openwall.com/lists/oss-security/2015/04/22/4 · Note