libgssapi and libgssglue before 0.4 do not properly check privileges, which allows local users to load untrusted configuration files and execute arbitrary code via the GSSAPI_MECH_CONF environment variable, as demonstrated using mount.nfs.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - libgssapi, libgssglue: Ability to load untrusted configuration file, when loading GSS mechanisms and their     definitions during initialization (CVE-2011-2709)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - libgssapi, libgssglue: Ability to load untrusted configuration file, when loading GSS mechanisms and their     definitions during initialization (CVE-2011-2709)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - libgssapi, libgssglue: Ability to load untrusted configuration file, when loading GSS mechanisms and their     definitions during initialization (CVE-2011-2709)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

This update fixes insecure getenv() usage in libgssglue, which could be used under some circumstances by local attackers do gain root privileges (CVE-2011-2709).

It was discovered that libgssglue incorrectly handled the GSSAPI_MECH_CONF environment variable when running a privileged binary. A local attacker could exploit this to gain root privileges.
(CVE-2011-2709).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201209-22 (libgssglue: Privilege escalation)

    libgssglue does not securely use getenv() when loading a library for a       setuid application.
  Impact :

    A local attacker could gain escalated privileges.
  Workaround :

    There is no known workaround at this time.

- Fix for CVE-2011-2709 Patch from Marcus Meissner Note:
    Although     https://bugzilla.novell.com/show_bug.cgi?id=694598     mentions mount.nfs, libgssglue is not used by mount.nfs.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198554	RHEL 5 : libgssapi (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198509	RHEL 6 : libgssapi (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198491	RHEL 4 : libgssapi (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
66057	Mandriva Linux Security Advisory : libgssglue (MDVSA-2013:043)	Nessus	Mandriva Local Security Checks	medium
62557	Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : libgssglue vulnerability (USN-1612-1)	Nessus	Ubuntu Local Security Checks	medium
62364	GLSA-201209-22 : libgssglue: Privilege escalation	Nessus	Gentoo Local Security Checks	medium
59531	Fedora 17 : libgssglue-0.4-0.fc17 (2012-7971)	Nessus	Fedora Local Security Checks	medium
59429	Fedora 16 : libgssglue-0.4-0.fc16 (2012-8067)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2011-2709

critical

Tenable Plugins

critical

critical

critical

medium

medium

medium

medium

medium