CVEvulnerability
CVE-2011-2709
6.2 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2012-06-21
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.2 MEDIUM — AV:L/AC:H/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-264
Description
libgssapi and libgssglue before 0.4 do not properly check privileges, which allows local users to load untrusted configuration files and execute arbitrary code via the GSSAPI_MECH_CONF environment variable, as demonstrated using mount.nfs.
Affected configurations
• umich libgssglue (<= 0.3)
• umich libgssglue 0.1
• umich libgssglue 0.2
• umich libgssapi (<= 0.3)
• umich libgssapi 0.1
• umich libgssapi 0.2
Related
Weakness · not in database (1)
References
- http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082072.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082297.html lists.fedoraproject.org
- http://lwn.net/Alerts/449415/ lwn.net
- http://secunia.com/advisories/45075 Vendor Advisory
- http://secunia.com/advisories/50785 secunia.com
- http://secunia.com/advisories/50973 secunia.com
- http://www.citi.umich.edu/projects/nfsv4/linux/libgssglue/libgssglue-0.4.tar.gz Patch
- http://www.openwall.com/lists/oss-security/2011/07/21/3 www.openwall.com
- http://www.openwall.com/lists/oss-security/2011/07/22/4 www.openwall.com
- http://www.openwall.com/lists/oss-security/2011/08/12/10 www.openwall.com
- http://www.securityfocus.com/bid/48490 www.securityfocus.com
- https://bugzilla.novell.com/show_bug.cgi?id=694598 bugzilla.novell.com
- http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082072.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082297.html lists.fedoraproject.org
- http://lwn.net/Alerts/449415/ lwn.net
- http://secunia.com/advisories/45075 Vendor Advisory
- http://secunia.com/advisories/50785 secunia.com
- http://secunia.com/advisories/50973 secunia.com
- http://www.citi.umich.edu/projects/nfsv4/linux/libgssglue/libgssglue-0.4.tar.gz Patch
- http://www.openwall.com/lists/oss-security/2011/07/21/3 www.openwall.com
- http://www.openwall.com/lists/oss-security/2011/07/22/4 www.openwall.com
- http://www.openwall.com/lists/oss-security/2011/08/12/10 www.openwall.com
- http://www.securityfocus.com/bid/48490 www.securityfocus.com
- https://bugzilla.novell.com/show_bug.cgi?id=694598 bugzilla.novell.com