autofs nosuid Mount Option Local Privilege Escalation Vulnerability

Bugtraq ID:	26841
Class:	Configuration Error
CVE:	CVE-2007-5964
Remote:	No
Local:	Yes
Published:	Dec 12 2007 12:00AM
Updated:	Jan 14 2008 07:29PM
Credit:	Josh Lange is credited with discovering this issue.
Vulnerable:	RedHat Enterprise Linux WS 4 RedHat Enterprise Linux ES 4 RedHat Desktop 4.0 Red Hat Fedora 8 Red Hat Fedora 7 Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux AS 4 Red Hat Enterprise Linux 5 Server Red Hat autofs5 5.0.1 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 Mandriva Linux Mandrake 2007.1 x86_64 Mandriva Linux Mandrake 2007.1 Mandriva Linux Mandrake 2007.0 x86_64 Mandriva Linux Mandrake 2007.0
Not Vulnerable:

autofs nosuid Mount Option Local Privilege Escalation Vulnerability

The 'autofs' utility is prone to a local privilege-escalation vulnerability because of a flaw in its default configuration. Filesystems mounted under '/net' using the 'hosts' automount map do not have the 'nosuid' mount option enabled by default.

Attackers can leverage this issue to gain superuser privileges. Successful exploits will completely compromise affected computers.

autofs nosuid Mount Option Local Privilege Escalation Vulnerability

To exploit this issue, local attackers can use readily available networking tools.

autofs nosuid Mount Option Local Privilege Escalation Vulnerability

Solution:
Red Hat has released updates to address this issue. Please see the references for more information.

autofs nosuid Mount Option Local Privilege Escalation Vulnerability

References:

• Bugzilla Bug 410031 autofs defaults don't restrict suid in /net (Red Hat)
  
• RHSA-2007:1128-6 autofs security update (Red Hat)
  
• RHSA-2007:1129-5 autofs5 security update (Red Hat)