CVE-2024-34477: High severity FOG FOG vulnerability
configureNFS in lib/common/functions.sh in FOG through 1.5.10 allows local users to gain privileges by mounting a crafted NFS share (because of norootsquash and insecure). In order to exploit the vulnerability, someone needs to mount an NFS share in order to add an executable file as root. In addition, the SUID bit must be added to this file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-34477?
CVE-2024-34477 is classified as a high severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2024-34477?
To mitigate CVE-2024-34477, ensure that the NFS shares are configured securely by disabling no_root_squash and securing access.
Who is affected by CVE-2024-34477?
CVE-2024-34477 affects FOG versions up to and including 1.5.10.
What type of attack is CVE-2024-34477 associated with?
CVE-2024-34477 is associated with local privilege escalation attacks through insecure NFS share configurations.
Can CVE-2024-34477 be exploited remotely?
CVE-2024-34477 requires local access to the system to mount a crafted NFS share for exploitation.