CVE-2007-6285: Medium severity redhat Enterprise Linux vulnerability
It was reported to secalert that the autofs defaults do not set the nodev NFS option.
bug 410031 notes the missing nosuid option by default for the /net autofs filesystems, the fix for that issue did not take into account that there was also a missing nodev option for these filesystems.
Without the nodev option, it is possible for an attacker to mount a remote filesystem which could give them access to various devices that should normally have restricted access, such as /dev/mem, and various hardware devices.
Acknowledgements:
Red Hat would like to thank Tim Baum for reporting this issue.
Other sources
The default configuration for autofs 5 (autofs5) in some Linux distributions, such as Red Hat Enterprise Linux (RHEL) 4 and 5, does not specify the nodev mount option for the -hosts map, which allows local users to access "important devices" by operating a remote NFS server and creating special device files on that server, as demonstrated by the /dev/mem device.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-6285?
CVE-2007-6285 is classified as a moderate severity vulnerability.
How do I fix CVE-2007-6285?
To fix CVE-2007-6285, you should update the autofs package to the latest version available for your Red Hat Enterprise Linux distribution.
What software is affected by CVE-2007-6285?
CVE-2007-6285 affects Red Hat Enterprise Linux versions 4.0 and 5.0.
What does CVE-2007-6285 relate to?
CVE-2007-6285 relates to the failure of autofs defaults to set the nodev option in NFS.
Is there a workaround for CVE-2007-6285?
A potential workaround for CVE-2007-6285 is to manually configure NFS mounts to include the nodev option.