CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 0CVE-2019-3689 – nfs-utils: root-owned files stored in insecure /var/lib/nfs directory
https://notcve.org/view.php?id=CVE-2019-3689
19 Sep 2019 — The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. This directory contains files owned and managed by root. If statd is compromised, it can therefore trick processes running with root privileges into creating/overwriting files anywhere on the system. El paquete nfs-utils en SUSE Linux Enterprise Server 12 en versiones anterior... • http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00071.html • CWE-276: Incorrect Default Permissions •
CVSS: 7.1EPSS: 0%CPEs: 4EXPL: 0CVE-2011-1749 – nfs-utils: mount.nfs fails to anticipate RLIMIT_FSIZE
https://notcve.org/view.php?id=CVE-2011-1749
26 Feb 2014 — The nfs_addmntent function in support/nfs/nfs_mntent.c in the mount.nsf tool in nfs-utils before 1.2.4 attempts to append to the /etc/mtab file without first checking whether resource limits would interfere, which allows local users to corrupt this file via a process with a small RLIMIT_FSIZE value, a related issue to CVE-2011-1089. La función nfs_addmntent en support/nfs/nfs_mntent.c en la herramienta mount.nsf en nfs-utils anterior a 1.2.4 intenta añadir al archivo /etc/mtab sin primero comprobar si los l... • http://rhn.redhat.com/errata/RHSA-2011-1534.html • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2011-2500 – nfs-utils: Improper authentication of an incoming request when an IP based authentication used
https://notcve.org/view.php?id=CVE-2011-2500
15 Feb 2014 — The host_reliable_addrinfo function in support/export/hostname.c in nfs-utils before 1.2.4 does not properly use DNS to verify access to NFS exports, which allows remote attackers to mount filesystems by establishing crafted DNS A and PTR records. La función host_reliable_addrinfo en support/export/hostname.c en nfs-utils anterior a 1.2.4 no utiliza debidamente DNS para verificar el acceso a exportaciones NFS, lo que permite a atacantes remotos montar sistemas de ficheros mediante el establecimiento de regi... • http://marc.info/?l=linux-nfs&m=130875695821953&w=2 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2013-1923 – Mandriva Linux Security Advisory 2013-178
https://notcve.org/view.php?id=CVE-2013-1923
25 Jun 2013 — rpc-gssd in nfs-utils before 1.2.8 performs reverse DNS resolution for server names during GSSAPI authentication, which might allow remote attackers to read otherwise-restricted files via DNS spoofing attacks. rpc-gssd en nfs-utils anterior a la versión 1.2.8 realiza resoluciones inversas de DNS en nombres de servidor durante la autenticación GSSAPI, lo que podría permitir a atacantes remotos leer archivos restringidos del mismo modo a través de ataques de falsificación de DNS. Updated nfs-utils packages fi... • http://lists.opensuse.org/opensuse-updates/2013-06/msg00142.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.1EPSS: 0%CPEs: 56EXPL: 0CVE-2009-0180
https://notcve.org/view.php?id=CVE-2009-0180
20 Jan 2009 — Certain Fedora build scripts for nfs-utils before 1.1.2-9.fc9 on Fedora 9, and before 1.1.4-6.fc10 on Fedora 10, omit TCP Wrapper support, which might allow remote attackers to bypass intended access restrictions, possibly a related issue to CVE-2008-1376. Algunos Fedora crean secuencias de comando para nfs-utils anteriores a v1.1.2-9.fc9 en Fedora 9, y anteriores a v1.1.4-6.fc10 en Fedora 10, no da soporte a TCP Wrapper, lo que podría permitir a atacantes remotos evitar las restricciones de acceso prevista... • http://secunia.com/advisories/33545 • CWE-264: Permissions, Privileges, and Access Controls •