'nfs-utils' Package for Fedora 9 and 10 TCP Wrappers Security Bypass Vulnerability

Bugtraq ID:	33294
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 15 2009 12:00AM
Updated:	Jan 30 2009 09:09PM
Credit:	Stever Dickson
Vulnerable:	RedHat nfs-utils 1.1.4 RedHat nfs-utils 1.1.2 Red Hat Fedora 9 Red Hat Fedora 10 Pardus Linux 2008 0
Not Vulnerable:	RedHat nfs-utils 1.1.4-6 .fc10 RedHat nfs-utils 1.1.2-9 .fc9

'nfs-utils' Package for Fedora 9 and 10 TCP Wrappers Security Bypass Vulnerability

The 'nfs-utils' package in Fedora 9 and 10 is prone to a security-bypass vulnerability because it wasn't built properly with support for TCP Wrappers.

Remote attackers can exploit this issue to bypass certain security restrictions and gain access to NFS services on vulnerable computers.

This issue affects versions *prior to* the following:

nfs-utils 1.1.2-9 on Fedora 9
nfs-utils 1.1.4-6 on Fedora 10

'nfs-utils' Package for Fedora 9 and 10 TCP Wrappers Security Bypass Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

'nfs-utils' Package for Fedora 9 and 10 TCP Wrappers Security Bypass Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for more information.

'nfs-utils' Package for Fedora 9 and 10 TCP Wrappers Security Bypass Vulnerability

References:

• nfs-utils Project Page (nfs-utils)
  
• Bugzilla Bug 477864 nfs-utils: missing tcp_wrappers support in Fedora 9 and 10 (Steve Dickson)
  
• FEDORA-2009-0266 nfs-utils-1.1.4-6.fc10 security update (Red Hat)
  
• FEDORA-2009-0297 Fedora 9 Update: nfs-utils-1.1.2-9.fc9 (Red Hat)