Lucene search

K
freebsdFreeBSDE5D2442D-5E76-11E6-A6C3-14DAE9D210B8
HistoryJul 06, 2013 - 12:00 a.m.

FreeBSD -- Incorrect privilege validation in the NFS server

2013-07-0600:00:00
vuxml.freebsd.org
21

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

0.003 Low

EPSS

Percentile

71.7%

Problem Description:
The kernel incorrectly uses client supplied credentials
instead of the one configured in exports(5) when filling out the
anonymous credential for a NFS export, when -network or -host
restrictions are used at the same time.
Impact:
The remote client may supply privileged credentials (e.g. the
root user) when accessing a file under the NFS share, which will bypass
the normal access checks.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchfreebsd-kernel= 9.1UNKNOWN
FreeBSDanynoarchfreebsd-kernel< 9.1_5UNKNOWN

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

0.003 Low

EPSS

Percentile

71.7%