[ GLSA 200903-06 ] nfs-utils: Access restriction bypass

[GLSA]

Gentoo Linux Security Advisory

Title: nfs-utils: Access restriction bypass (GLSA 200903-06)
Severity: normal
Exploitable: remote
Date: March 07, 2009
Bug(s): #242696
ID: 200903-06

Synopsis


An error in nfs-utils allows for bypass of the netgroups restriction.


Background


nfs-utils contains the client and daemon implementations for the NFS
protocol.


Affected Packages

Package: net-fs/nfs-utils
Vulnerable: < 1.1.3
Unaffected: >= 1.1.3
Architectures: All supported architectures


Description


Michele Marcionelli reported that nfs-utils invokes the hosts_ctl()
function with the wrong order of arguments, which causes TCP Wrappers
to ignore netgroups.


Impact


A remote attacker could bypass intended access restrictions, i.e. NFS
netgroups, and gain access to restricted services.


Workaround


There is no known workaround at this time.


Resolution


All nfs-utils users should upgrade to the latest version: