CVE-2013-4851

Published: Jul 29, 2013Modified: Apr 29, 2026

6.4

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability: 10.0 / Impact: 4.9

Source: NVD

Description

The vfs_hang_addrlist function in sys/kern/vfs_export.c in the NFS server implementation in the kernel in FreeBSD 8.3 and 9.x through 9.1-RELEASE-p5 controls authorization for host/subnet export entries on the basis of group information sent by the client, which allows remote attackers to bypass file permissions on NFS filesystems via crafted requests.

Affected (5)

Products: Freebsd: Freebsd

1 product

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Freebsd Freebsd	Version 8.3
Freebsd Freebsd	Version 9.0
Freebsd Freebsd	Version 9.1
Freebsd Freebsd	Version 9.1 p4
Freebsd Freebsd	Version 9.1 p5

Related CWEs

References (6)

http://svnweb.freebsd.org/base?view=revision&revision=244226

Source: cve@mitre.org

http://www.freebsd.org/security/advisories/FreeBSD-SA-13:08.nfsserver.asc

Source: cve@mitre.org

http://www.securityfocus.com/bid/61484

Source: cve@mitre.org

http://svnweb.freebsd.org/base?view=revision&revision=244226

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.freebsd.org/security/advisories/FreeBSD-SA-13:08.nfsserver.asc

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/61484

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.