A security flaw was found in the way nfs-utils performed authentication of an incoming request, when an IP based authentication mechanism was used and certain file systems were exported to either to a netgroup or a wildcard (e.g. .my.domain), and some file systems (either the same or different to the first set) were exported to specific hosts, IP addresses, or a subnet. A remote attacker, able to create global DNS entries could use this flaw to access above listed, exported file systems.

References: [1] https://bugzilla.novell.com/showbug.cgi?id=701702 [2] http://www.openwall.com/lists/oss-security/2011/06/27/7 (CVE Request)

Relevant upstream patch: [3] http://marc.info/?l=linux-nfs&m=130875695821953&w=2

Certain Fedora build scripts for nfs-utils before 1.1.2-9.fc9 on Fedora 9, and before 1.1.4-6.fc10 on Fedora 10, omit TCP Wrapper support, which might allow remote attackers to bypass intended access restrictions, possibly a related issue to CVE-2008-1376.

It seems that tcpwrappers does not honor netgroups. As this was noted in a different unrelated bug, I'm opening this one: https://bugzilla.redhat.com/showbug.cgi?id=440114#c8

It seems that netgroups are not working; if I put in my hosts.allow file

mountd: hostname - or - mountd: ip-address

then I can mount, but if I have a netgroup, I can't... for instance

mountd: @selectedhosts

Can you confirm this behaviour?

rquotad in nfs-utils (rquotaserver.c) before 1.0.6-r6 on 64-bit architectures does not properly perform an integer conversion, which leads to a stack-based buffer overflow and allows remote attackers to execute arbitrary code via a crafted NFS request.

statd in nfs-utils 1.257 and earlier does not ignore the SIGPIPE signal, which allows remote attackers to cause a denial of service (server process crash) via a TCP connection that is prematurely terminated.

rpc.mountd in nfs-utils after 1.0.3 and before 1.0.6 allows attackers to cause a denial of service (crash) via an NFS mount of a directory from a client whose reverse DNS lookup name is different from the forward lookup name.

Off-by-one error in the xlog function of mountd in the Linux NFS utils package (nfs-utils) before 1.0.4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via certain RPC requests to mountd that do not contain newlines.