'nfs-utils' Package 'hosts_ctl()' Security Bypass Vulnerability

Bugtraq ID:	31823
Class:	Design Error
CVE:	CVE-2008-4552
Remote:	Yes
Local:	No
Published:	Aug 11 2008 12:00AM
Updated:	Mar 04 2010 03:42PM
Credit:	Michele Marcionelli
Vulnerable:	VMWare vMA 4.0 VMWare ESX Server 4.0 Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 7.10 sparc Ubuntu Ubuntu Linux 7.10 powerpc Ubuntu Ubuntu Linux 7.10 lpia Ubuntu Ubuntu Linux 7.10 i386 Ubuntu Ubuntu Linux 7.10 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise Server 10 SP2 SuSE Suse Linux Enterprise Desktop 10 SP2 SuSE SUSE Linux Enterprise 10 SP2 DEBUGINFO S.u.S.E. Open-Enterprise-Server 0 S.u.S.E. Novell Linux POS 9 S.u.S.E. Novell Linux Desktop 9 rPath rPath Linux 2 rPath rPath Linux 1 rPath Appliance Platform Linux Service 2 rPath Appliance Platform Linux Service 1 Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux 5 Server Pardus Linux 2008 0 nfs nfs-utils 1.0.9 Mandriva Linux Mandrake 2008.1 x86_64 Mandriva Linux Mandrake 2008.1 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 MandrakeSoft Multi Network Firewall 2.0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 Gentoo Linux Avaya Aura Session Manager 1.1
Not Vulnerable:	nfs nfs-utils 1.1.3

'nfs-utils' Package 'hosts_ctl()' Security Bypass Vulnerability

The 'nfs-utils' package is prone to a security-bypass vulnerability.

Remote attackers can exploit this issue to bypass certain security restrictions and gain access to vulnerable computers.

This issue affects 'nfs-utils' 1.0.9; other versions prior to 1.1.3 may also be vulnerable.

'nfs-utils' Package 'hosts_ctl()' Security Bypass Vulnerability

An attacker may exploit this issue using commonly available tools.

'nfs-utils' Package 'hosts_ctl()' Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.


Mandriva Linux Mandrake 2008.1 x86_64

• Mandriva nfs-utils-1.1.1-9.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva nfs-utils-clients-1.1.1-9.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 7.10 powerpc

• Ubuntu nfs-common_1.1.1~git-20070709-3ubuntu1.1_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-common_1.1 .1~git-20070709-3ubuntu1.1_powerpc.deb


• Ubuntu nfs-kernel-server_1.1.1~git-20070709-3ubuntu1.1_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-kernel-ser ver_1.1.1~git-20070709-3ubuntu1.1_powerpc.deb

Mandriva Linux Mandrake 2008.1

• Mandriva nfs-utils-1.1.1-9.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva nfs-utils-clients-1.1.1-9.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.04 LTS powerpc

• Ubuntu nfs-common_1.1.2-2ubuntu2.2_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/nfs-utils/nfs-common_1.1.2-2ubuntu 2.2_powerpc.deb


• Ubuntu nfs-kernel-server_1.1.2-2ubuntu2.2_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/nfs-utils/nfs-kernel-server_1.1.2- 2ubuntu2.2_powerpc.deb

Ubuntu Ubuntu Linux 8.10 powerpc

• Ubuntu nfs-common_1.1.2-4ubuntu1.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/nfs-utils/nfs-common_1.1.2-4ubuntu 1.1_powerpc.deb


• Ubuntu nfs-kernel-server_1.1.2-4ubuntu1.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/nfs-utils/nfs-kernel-server_1.1.2- 4ubuntu1.1_powerpc.deb

Ubuntu Ubuntu Linux 8.10 i386

• Ubuntu nfs-common_1.1.2-4ubuntu1.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-common_1.1 .2-4ubuntu1.1_i386.deb


• Ubuntu nfs-kernel-server_1.1.2-4ubuntu1.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-kernel-ser ver_1.1.2-4ubuntu1.1_i386.deb

Ubuntu Ubuntu Linux 8.04 LTS sparc

• Ubuntu nfs-common_1.1.2-2ubuntu2.2_sparc.deb
  http://ports.ubuntu.com/pool/main/n/nfs-utils/nfs-common_1.1.2-2ubuntu 2.2_sparc.deb


• Ubuntu nfs-kernel-server_1.1.2-2ubuntu2.2_sparc.deb
  http://ports.ubuntu.com/pool/main/n/nfs-utils/nfs-kernel-server_1.1.2- 2ubuntu2.2_sparc.deb

Ubuntu Ubuntu Linux 6.06 LTS sparc

• Ubuntu nfs-common_1.0.7-3ubuntu2.1_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-common_1.0 .7-3ubuntu2.1_sparc.deb


• Ubuntu nfs-kernel-server_1.0.7-3ubuntu2.1_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-kernel-ser ver_1.0.7-3ubuntu2.1_sparc.deb


• Ubuntu nhfsstone_1.0.7-3ubuntu2.1_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nfs-utils/nhfsstone_ 1.0.7-3ubuntu2.1_sparc.deb

Mandriva Linux Mandrake 2008.0 x86_64

• Mandriva nfs-utils-1.1.0-12.2mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva nfs-utils-clients-1.1.0-12.2mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 6.06 LTS powerpc

• Ubuntu nfs-common_1.0.7-3ubuntu2.1_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-common_1.0 .7-3ubuntu2.1_powerpc.deb


• Ubuntu nfs-kernel-server_1.0.7-3ubuntu2.1_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-kernel-ser ver_1.0.7-3ubuntu2.1_powerpc.deb


• Ubuntu nhfsstone_1.0.7-3ubuntu2.1_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nfs-utils/nhfsstone_ 1.0.7-3ubuntu2.1_powerpc.deb

Ubuntu Ubuntu Linux 8.04 LTS amd64

• Ubuntu nfs-common_1.1.2-2ubuntu2.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-common_1.1 .2-2ubuntu2.2_amd64.deb


• Ubuntu nfs-kernel-server_1.1.2-2ubuntu2.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-kernel-ser ver_1.1.2-2ubuntu2.2_amd64.deb

Mandriva Linux Mandrake 2008.0

• Mandriva nfs-utils-1.1.0-12.2mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva nfs-utils-clients-1.1.0-12.2mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 7.10 sparc

• Ubuntu nfs-common_1.1.1~git-20070709-3ubuntu1.1_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-common_1.1 .1~git-20070709-3ubuntu1.1_sparc.deb


• Ubuntu nfs-kernel-server_1.1.1~git-20070709-3ubuntu1.1_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-kernel-ser ver_1.1.1~git-20070709-3ubuntu1.1_sparc.deb

Ubuntu Ubuntu Linux 8.04 LTS lpia

• Ubuntu nfs-common_1.1.2-2ubuntu2.2_lpia.deb
  http://ports.ubuntu.com/pool/main/n/nfs-utils/nfs-common_1.1.2-2ubuntu 2.2_lpia.deb


• Ubuntu nfs-kernel-server_1.1.2-2ubuntu2.2_lpia.deb
  http://ports.ubuntu.com/pool/main/n/nfs-utils/nfs-kernel-server_1.1.2- 2ubuntu2.2_lpia.deb

Ubuntu Ubuntu Linux 6.06 LTS i386

• Ubuntu nfs-common_1.0.7-3ubuntu2.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-common_1.0 .7-3ubuntu2.1_i386.deb


• Ubuntu nfs-kernel-server_1.0.7-3ubuntu2.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-kernel-ser ver_1.0.7-3ubuntu2.1_i386.deb


• Ubuntu nhfsstone_1.0.7-3ubuntu2.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nfs-utils/nhfsstone_ 1.0.7-3ubuntu2.1_i386.deb

Ubuntu Ubuntu Linux 7.10 lpia

• Ubuntu nfs-common_1.1.1~git-20070709-3ubuntu1.1_lpia.deb
  http://ports.ubuntu.com/pool/main/n/nfs-utils/nfs-common_1.1.1~git-200 70709-3ubuntu1.1_lpia.deb


• Ubuntu nfs-kernel-server_1.1.1~git-20070709-3ubuntu1.1_lpia.deb
  http://ports.ubuntu.com/pool/main/n/nfs-utils/nfs-kernel-server_1.1.1~ git-20070709-3ubuntu1.1_lpia.deb

Ubuntu Ubuntu Linux 8.10 lpia

• Ubuntu nfs-common_1.1.2-4ubuntu1.1_lpia.deb
  http://ports.ubuntu.com/pool/main/n/nfs-utils/nfs-common_1.1.2-4ubuntu 1.1_lpia.deb


• Ubuntu nfs-kernel-server_1.1.2-4ubuntu1.1_lpia.deb
  http://ports.ubuntu.com/pool/main/n/nfs-utils/nfs-kernel-server_1.1.2- 4ubuntu1.1_lpia.deb

Ubuntu Ubuntu Linux 7.10 i386

• Ubuntu nfs-common_1.1.1~git-20070709-3ubuntu1.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-common_1.1 .1~git-20070709-3ubuntu1.1_i386.deb


• Ubuntu nfs-kernel-server_1.1.1~git-20070709-3ubuntu1.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-kernel-ser ver_1.1.1~git-20070709-3ubuntu1.1_i386.deb

Ubuntu Ubuntu Linux 6.06 LTS amd64

• Ubuntu nfs-common_1.0.7-3ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-common_1.0 .7-3ubuntu2.1_amd64.deb


• Ubuntu nfs-kernel-server_1.0.7-3ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-kernel-ser ver_1.0.7-3ubuntu2.1_amd64.deb


• Ubuntu nhfsstone_1.0.7-3ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nfs-utils/nhfsstone_ 1.0.7-3ubuntu2.1_amd64.deb

Ubuntu Ubuntu Linux 8.10 sparc

• Ubuntu nfs-common_1.1.2-4ubuntu1.1_sparc.deb
  http://ports.ubuntu.com/pool/main/n/nfs-utils/nfs-common_1.1.2-4ubuntu 1.1_sparc.deb


• Ubuntu nfs-kernel-server_1.1.2-4ubuntu1.1_sparc.deb
  http://ports.ubuntu.com/pool/main/n/nfs-utils/nfs-kernel-server_1.1.2- 4ubuntu1.1_sparc.deb

MandrakeSoft Corporate Server 4.0

• Mandriva nfs-utils-1.0.9-0.1.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva nfs-utils-1.0.9-1.1.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva nfs-utils-clients-1.0.9-0.1.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva nfs-utils-clients-1.0.9-1.1.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 7.10 amd64

• Ubuntu nfs-common_1.1.1~git-20070709-3ubuntu1.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-common_1.1 .1~git-20070709-3ubuntu1.1_amd64.deb


• Ubuntu nfs-kernel-server_1.1.1~git-20070709-3ubuntu1.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-kernel-ser ver_1.1.1~git-20070709-3ubuntu1.1_amd64.deb

Ubuntu Ubuntu Linux 8.04 LTS i386

• Ubuntu nfs-common_1.1.2-2ubuntu2.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-common_1.1 .2-2ubuntu2.2_i386.deb


• Ubuntu nfs-kernel-server_1.1.2-2ubuntu2.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-kernel-ser ver_1.1.2-2ubuntu2.2_i386.deb

Ubuntu Ubuntu Linux 8.10 amd64

• Ubuntu nfs-common_1.1.2-4ubuntu1.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-common_1.1 .2-4ubuntu1.1_amd64.deb


• Ubuntu nfs-kernel-server_1.1.2-4ubuntu1.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-kernel-ser ver_1.1.2-4ubuntu1.1_amd64.deb

MandrakeSoft Multi Network Firewall 2.0

• Mandriva nfs-utils-1.0.6-2.3.100mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva nfs-utils-clients-1.0.6-2.3.100mdk.i586.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Corporate Server 3.0 x86_64

• Mandriva nfs-utils-1.0.6-2.3.100mdk.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva nfs-utils-clients-1.0.6-2.3.100mdk.x86_64.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Corporate Server 3.0

• Mandriva nfs-utils-1.0.6-2.3.100mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva nfs-utils-clients-1.0.6-2.3.100mdk.i586.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Corporate Server 4.0 x86_64

• Mandriva nfs-utils-1.0.9-0.1.20060mlcs4.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva nfs-utils-1.0.9-1.1.20060mlcs4.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva nfs-utils-clients-1.0.9-0.1.20060mlcs4.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva nfs-utils-clients-1.0.9-1.1.20060mlcs4.x86_64.rpm
  http://www.mandriva.com/en/download/

'nfs-utils' Package 'hosts_ctl()' Security Bypass Vulnerability

References:

• ASA-2009-395 (Avaya)
  
• Bug 458676 - (CVE-2008-4552) CVE-2008-4552 nfs-utils: does not honor netgroups (Josh Bressers)
  
• nfs-utils Project Page (nfs-utils)