CVE-2011-2709

Published: Jun 21, 2012

Modified: Aug 6, 2024

PUBLISHED

Description

libgssapi and libgssglue before 0.4 do not properly check privileges, which allows local users to load untrusted configuration files and execute arbitrary code via the GSSAPI_MECH_CONF environment variable, as demonstrated using mount.nfs.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

[oss-security] 20110721 CVE Request -- libgssapi, libgssglue -- Ability to load untrusted configuration file, when loading GSS mechanisms and their definitions during initialization

mailing-list

x_refsource_MLIST

https://bugzilla.novell.com/show_bug.cgi?id=694598

x_refsource_MISC

FEDORA-2012-7971

vendor-advisory

x_refsource_FEDORA

45075

third-party-advisory

x_refsource_SECUNIA

48490

vdb-entry

x_refsource_BID

http://www.citi.umich.edu/projects/nfsv4/linux/libgssglue/libgssglue-0.4.tar.gz

x_refsource_CONFIRM

[oss-security] 20110722 Re: CVE Request -- libgssapi, libgssglue -- Ability to load untrusted configuration file, when loading GSS mechanisms and their definitions during initialization

mailing-list

x_refsource_MLIST

FEDORA-2012-8067

vendor-advisory

x_refsource_FEDORA

[oss-security] 20110812 Re: CVE Request -- libgssapi, libgssglue -- Ability to load untrusted configuration file, when loading GSS mechanisms and their definitions during initialization

mailing-list

x_refsource_MLIST

50785

third-party-advisory

x_refsource_SECUNIA

50973

third-party-advisory

x_refsource_SECUNIA

SUSE-SU-2011:0696

vendor-advisory

x_refsource_SUSE

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2011-2709

Description

Affected Products

References