CVE-2011-2709

libgssapi and libgssglue before 0.4 do not properly check privileges, which allows local users to load untrusted configuration files and execute arbitrary code via the GSSAPI_MECH_CONF environment variable, as demonstrated using mount.nfs.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.2 UNKNOWN
LOCAL
HIGH
AV:L/AC:H/Au:N/C:C/I:C/A:C
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 31%
VendorProductVersion
umichlibgssglue
𝑥
≤ 0.3
umichlibgssglue
0.1
umichlibgssglue
0.2
umichlibgssapi
𝑥
≤ 0.3
umichlibgssapi
0.1
umichlibgssapi
0.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libgssglue
bullseye
0.4-2
fixed
squeeze
no-dsa
bookworm
0.7-1.1
fixed
sid
0.9-1
fixed
trixie
0.9-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libgssglue
precise
Fixed 0.3-4ubuntu0.1
released
oneiric
Fixed 0.3-1ubuntu1.1
released
natty
Fixed 0.1-4ubuntu1.1
released
maverick
ignored
lucid
Fixed 0.1-4ubuntu0.1
released
hardy
ignored
Common Weakness Enumeration
References
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082072.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082297.html
http://lwn.net/Alerts/449415/
http://secunia.com/advisories/45075
http://secunia.com/advisories/50785
http://secunia.com/advisories/50973
http://www.citi.umich.edu/projects/nfsv4/linux/libgssglue/libgssglue-0.4.tar.gz
http://www.openwall.com/lists/oss-security/2011/07/21/3
http://www.openwall.com/lists/oss-security/2011/07/22/4
http://www.openwall.com/lists/oss-security/2011/08/12/10
http://www.securityfocus.com/bid/48490
https://bugzilla.novell.com/show_bug.cgi?id=694598
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082072.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082297.html
http://lwn.net/Alerts/449415/
http://secunia.com/advisories/45075
http://secunia.com/advisories/50785
http://secunia.com/advisories/50973
http://www.citi.umich.edu/projects/nfsv4/linux/libgssglue/libgssglue-0.4.tar.gz
http://www.openwall.com/lists/oss-security/2011/07/21/3
http://www.openwall.com/lists/oss-security/2011/07/22/4
http://www.openwall.com/lists/oss-security/2011/08/12/10
http://www.securityfocus.com/bid/48490
https://bugzilla.novell.com/show_bug.cgi?id=694598