NFSv4 ID Mapper nfsidmap Username Lookup Local Privilege Escalation Vulnerability

Bugtraq ID:	26767
Class:	Access Validation Error
CVE:	CVE-2007-4135
Remote:	No
Local:	Yes
Published:	Dec 07 2007 12:00AM
Updated:	Dec 10 2007 02:52PM
Credit:	Tony Ernst from SGI discovered this issue.
Vulnerable:	SuSE Linux Enterprise Server 10 + Linux kernel 2.6.5 Redhat Enterprise Linux Desktop Workstation 5 client Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux 5 Server Mandriva Linux Mandrake 2007.0 x86_64 Mandriva Linux Mandrake 2007.0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 4.0
Not Vulnerable:	CITI nfsidmap 0.17

NFSv4 ID Mapper nfsidmap Username Lookup Local Privilege Escalation Vulnerability

The 'nfsidmap' utility is prone to a local privilege-escalation vulnerability because it fails to adequately handle files that have unknown owners.

Attackers can leverage this issue to gain superuser privileges. Successful exploits will completely compromise affected computers.

Versions prior to 'nfsidmap' 0.17 are vulnerable.

NFSv4 ID Mapper nfsidmap Username Lookup Local Privilege Escalation Vulnerability

Currently we are not aware of any working exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

NFSv4 ID Mapper nfsidmap Username Lookup Local Privilege Escalation Vulnerability

Solution:
The vendor released an updated version of nfsidmap to address this issue. Please see the references for more information.

NFSv4 ID Mapper nfsidmap Username Lookup Local Privilege Escalation Vulnerability

References:

• Vendor Homepage (CITI)
  
• RHSA-2007:0951-2 Important: nfs-utils-lib security update (Red Hat)