Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2011-2709

Overview

Vulnerability Score 6.2 6.2
CVE Id CVE-2011-2709
Last Modified 01 Mar 2013 11:33:00
Published 21 Jun 2012 11:55:10
Confidentiality Impact COMPLETE COMPLETE
Integrity Impact COMPLETE COMPLETE
Availability Impact COMPLETE COMPLETE
Access Vector LOCAL
Access Complexity HIGH
Authentication NONE

CVE-2011-2709

Summary

libgssapi and libgssglue before 0.4 do not properly check privileges, which allows local users to load untrusted configuration files and execute arbitrary code via the GSSAPI_MECH_CONF environment variable, as demonstrated using mount.nfs.

Vulnerable Systems

Application

  • Umich Libgssapi 0.1

  • Umich Libgssapi 0.2

  • Umich Libgssapi 0.3

  • Umich Libgssglue 0.1

  • Umich Libgssglue 0.2

  • Umich Libgssglue 0.3


References

MISC - https://bugzilla.novell.com/show_bug.cgi?id=694598

BID - 48490

MLIST - [oss-security] 20110812 Re: CVE Request -- libgssapi, libgssglue -- Ability to load untrusted configuration file, when loading GSS mechanisms and their definitions during initialization

MLIST - [oss-security] 20110722 Re: CVE Request -- libgssapi, libgssglue -- Ability to load untrusted configuration file, when loading GSS mechanisms and their definitions during initialization

MLIST - [oss-security] 20110721 CVE Request -- libgssapi, libgssglue -- Ability to load untrusted configuration file, when loading GSS mechanisms and their definitions during initialization

CONFIRM - http://www.citi.umich.edu/projects/nfsv4/linux/libgssglue/libgssglue-0.4.tar.gz

SECUNIA - 45075

SUSE - SUSE-SU-2011:0696

FEDORA - FEDORA-2012-7971

FEDORA - FEDORA-2012-8067

SECUNIA - 50973

SECUNIA - 50785


Last Updated: 27 May 2016 10:56:34