CVE-2007-5964: Medium severity redhat Enterprise Linux vulnerability
Reported to the Red Hat Security Response Team via secalert:
"A stock install of RHEL5 and Fedora 8 (and possibly earlier versions) have /net managed by autofs (look at /etc/auto.master).
Unfortunately, the "nosuid" mount option is not specified, meaning that any system auto-mounted under /net may have arbitrary suid root binaries.
How to exploit this vulnerability: An attacker can set up an NFS server on a remote host, and connect to the vulnerable system with an unprivileged user account. From here, the attacker can change directory to /net/remote.host.tld/export on the vulnerable system, and execute arbitrary "setuid root" binaries that they have placed on their nfs server."
Acknowledgements:
Red Hat would like to thank Josh Lange for reporting this issue.
Other sources
The default configuration of autofs 5 in some Linux distributions, such as Red Hat Enterprise Linux (RHEL) 5, omits the nosuid option for the hosts (/net filesystem) map, which allows local users to gain privileges via a setuid program on a remote NFS server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-5964?
CVE-2007-5964 is considered to have moderate severity due to the potential for privilege escalation.
How do I fix CVE-2007-5964?
To fix CVE-2007-5964, you should modify the autofs configuration to include the 'nosuid' mount option in the /etc/auto.master file.
What versions of Red Hat are affected by CVE-2007-5964?
CVE-2007-5964 affects Red Hat Enterprise Linux 5.0, Fedora 8, and possibly earlier versions.
What is the impact of not addressing CVE-2007-5964?
Failing to address CVE-2007-5964 may allow malicious users to execute setuid binaries from untrusted network shares.
Is CVE-2007-5964 patched in later versions of Red Hat?
Yes, CVE-2007-5964 is patched in subsequent updates of Red Hat Enterprise Linux and Fedora.