CVE-2007-5964: Medium severity redhat Enterprise Linux vulnerability
Reported to the Red Hat Security Response Team via secalert:
"A stock install of RHEL5 and Fedora 8 (and possibly earlier versions) have /net managed by autofs (look at /etc/auto.master).
Unfortunately, the "nosuid" mount option is not specified, meaning that any system auto-mounted under /net may have arbitrary suid root binaries.
How to exploit this vulnerability: An attacker can set up an NFS server on a remote host, and connect to the vulnerable system with an unprivileged user account. From here, the attacker can change directory to /net/remote.host.tld/export on the vulnerable system, and execute arbitrary "setuid root" binaries that they have placed on their nfs server."
Acknowledgements:
Red Hat would like to thank Josh Lange for reporting this issue.
Other sources
The default configuration of autofs 5 in some Linux distributions, such as Red Hat Enterprise Linux (RHEL) 5, omits the nosuid option for the hosts (/net filesystem) map, which allows local users to gain privileges via a setuid program on a remote NFS server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/autofsto a version that resolves this vulnerability.Fixed in 3.1.4-8 - Upgrade
Upgrade
debian/autofsto a version that resolves this vulnerability.Fixed in 5.1.8-2+deb12u2Fixed in 5.1.9-1.2 - Configuration
Add the nosuid mount option to the hosts (/net filesystem) map configuration managed by autofs, as configured in /etc/auto.master, to prevent execution of setuid binaries from remote NFS mounts.
autofs 5 hosts (/net filesystem) map nosuid mount option = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2007-5964?
CVE-2007-5964 is considered to have moderate severity due to the potential for privilege escalation.
How do I fix CVE-2007-5964?
To fix CVE-2007-5964, you should modify the autofs configuration to include the 'nosuid' mount option in the /etc/auto.master file.
What versions of Red Hat are affected by CVE-2007-5964?
CVE-2007-5964 affects Red Hat Enterprise Linux 5.0, Fedora 8, and possibly earlier versions.
What is the impact of not addressing CVE-2007-5964?
Failing to address CVE-2007-5964 may allow malicious users to execute setuid binaries from untrusted network shares.
Is CVE-2007-5964 patched in later versions of Red Hat?
Yes, CVE-2007-5964 is patched in subsequent updates of Red Hat Enterprise Linux and Fedora.