CVE-2007-6285 The default configuration for autofs 5 (autofs5) in some Linux distributions, such as Red Hat Enterprise Linux (RHEL) 4 and 5, does not specify the nodev mount option for the -hosts map, which allows....
MediumCVSS 6.2
EPSS 0.36%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The default configuration for autofs 5 (autofs5) in some Linux distributions, such as Red Hat Enterprise Linux (RHEL) 4 and 5, does not specify the nodev mount option for the -hosts map, which allows local users to access "important devices" by operating a remote NFS server and creating special device files on that server, as demonstrated by the /dev/mem device.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat enterprise linux | = 4.0 | No fix listed |
| redhat enterprise linux | = 5.0 | No fix listed |
References
- 40442 vdb-entry
- RHSA-2007:1176 vendor-advisory
- RHSA-2007:1177 vendor-advisory
- 28156 third-party-advisory vendor-advisory
- 28168 third-party-advisory vendor-advisory
- 28456 third-party-advisory vendor-advisory
- 1019137 vdb-entry
- MDVSA-2008:009 vendor-advisory
- 26970 vdb-entry
- bugzilla.redhat.com
- autofs-hostsmap-weak-securtiy(39188) vdb-entry
- oval:org.mitre.oval:def:11457 signature vdb-entry
- FEDORA-2007-4707 vendor-advisory
- FEDORA-2007-4709 vendor-advisory
- Debian Security Tracker CVE-2007-6285 vendor-advisory