The NFSv4 ID mapper (nfsidmap) before 0.17 does not properly handle return values from the getpwnam_r function when performing a username lookup, which can cause it to report a file as being owned by "root" instead of "nobody" if the file exists on the server but not on the client.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0951 advisory.

    [1.0.8-7.2.z2]
     - Updated libnfsidmap to -17 to fix a security issue (bz 254041)

     [1.0.8-7.2.z1]
     -  Fixed RPC library buffer overflow (bz 265061)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Details :

Tenable Network Security discovered a stack-based buffer overflow flaw in the RPC library used by nfs-utils-lib. A remote unauthenticated attacker who can access an application linked against nfs-utils-lib could trigger this flaw and cause the application to crash. On Red Hat Enterprise Linux 5 it is not possible to exploit this flaw to run arbitrary code as the overflow is blocked by FORTIFY_SOURCE.
(CVE-2007-3999)

Tony Ernst from SGI has discovered a flaw in the way nfsidmap maps NFSv4 unknown uids. If an unknown user ID is encountered on an NFSv4 mounted filesystem, the files will default to being owned by 'root' rather than 'nobody'. (CVE-2007-4135)

An updated nfs-utils-lib package to correct two security flaws is now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The nfs-utils-lib package contains support libraries that are needed by the commands and daemons of the nfs-utils package.

The updated nfs-utils package fixes the following vulnerabilities :

Tenable Network Security discovered a stack-based buffer overflow flaw in the RPC library used by nfs-utils-lib. A remote unauthenticated attacker who can access an application linked against nfs-utils-lib could trigger this flaw and cause the application to crash. On Red Hat Enterprise Linux 5 it is not possible to exploit this flaw to run arbitrary code as the overflow is blocked by FORTIFY_SOURCE.
(CVE-2007-3999)

Tony Ernst from SGI has discovered a flaw in the way nfsidmap maps NFSv4 unknown uids. If an unknown user ID is encountered on an NFSv4 mounted filesystem, the files will default to being owned by 'root' rather than 'nobody'. (CVE-2007-4135)

Users of nfs-utils-lib are advised to upgrade to this updated package, which contains backported patches to resolve these issues.

The NFSv4 ID mapper prior to 0.17 did not properly handle return values from the getpwnam_r() function when performing a username lookup, which could cause it to report a file as being owned by 'root' instead of 'nobody' if the file exists on the server but not the client.

The updated packages have been patched to correct these issues.

ID	Name	Product	Family	Severity
67582	Oracle Linux 5 : Important: / nfs-utils-lib (ELSA-2007-0951)	Nessus	Oracle Linux Local Security Checks	critical
60260	Scientific Linux Security Update : nfs-utils-lib on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
43655	CentOS 5 : nfs-utils-lib (CESA-2007:0951)	Nessus	CentOS Local Security Checks	critical
29298	Mandrake Linux Security Advisory : libnfsidmap (MDKSA-2007:240)	Nessus	Mandriva Local Security Checks	medium
26907	RHEL 5 : nfs-utils-lib (RHSA-2007:0951)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2007-4135

critical

Tenable Plugins

critical

critical

critical

medium

critical