CVE-2011-2709

Published: Jun 21, 2012Modified: Apr 29, 2026

6.2

Vector

AV:L/AC:H/Au:N/C:C/I:C/A:C

Exploitability: 1.9 / Impact: 10.0

Source: NVD

Description

libgssapi and libgssglue before 0.4 do not properly check privileges, which allows local users to load untrusted configuration files and execute arbitrary code via the GSSAPI_MECH_CONF environment variable, as demonstrated using mount.nfs.

Affected (6)

Products: Umich: Libgssglue, Libgssapi

Umich

2 products

Libgssglue

Libgssapi

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Umich Libgssglue	version ≤ 0.3
Umich Libgssglue	Version 0.1
Umich Libgssglue	Version 0.2

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Umich Libgssapi	version ≤ 0.3
Umich Libgssapi	Version 0.1
Umich Libgssapi	Version 0.2

Related CWEs

CWE-264

References (24)

http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082072.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082297.html

Source: secalert@redhat.com

http://lwn.net/Alerts/449415/

Source: secalert@redhat.com

http://secunia.com/advisories/45075

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/50785

Source: secalert@redhat.com

http://secunia.com/advisories/50973

Source: secalert@redhat.com

http://www.citi.umich.edu/projects/nfsv4/linux/libgssglue/libgssglue-0.4.tar.gz

Source: secalert@redhat.com

Patch

http://www.openwall.com/lists/oss-security/2011/07/21/3

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2011/07/22/4

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2011/08/12/10

Source: secalert@redhat.com

http://www.securityfocus.com/bid/48490

Source: secalert@redhat.com

https://bugzilla.novell.com/show_bug.cgi?id=694598

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082072.html