ID de Prueba:	1.3.6.1.4.1.25623.1.0.60243
Categoría:	Mandrake Local Security Checks
Título:	Mandrake Security Advisory MDVSA-2008:009-1 (autofs)
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing an update to autofs announced via advisory MDVSA-2008:009-1. The default behaviour of autofs 5 for the hosts map did not specify the nosuid and nodev mount options. This could allow a local user with control of a remote NFS server to create a setuid root executable on the exported filesystem of the remote NFS server. If this filesystem was mounted with the default hosts map, it would allow the user to obtain root privileges (CVE-2007-5964). Likewise, the same scenario would be available for local users able to create device files on the exported filesystem which could allow the user to gain access to important system devices (CVE-2007-6285). Because the default behaviour of autofs was to mount -hosts map entries with the dev and suid options enabled by default, autofs has been altered to always use nodev and nosuid by default. In order to have the old behaviour, the configuration must now explicitly set the dev and/or suid options. This change only affects the -hosts map which corresponds to the /net entry in the default configuration. Update: The previous update shipped with an incorrect LDAP lookup module that would prevent the automount daemon from starting. This update corrects that problem. Affected: 2007.1, 2008.0 Solution: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. http://www.securityspace.com/smysecure/catid.html?in=MDVSA-2008:009-1 Risk factor : High CVSS Score: 6.9
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2007-5964 BugTraq ID: 26841 http://www.securityfocus.com/bid/26841 https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00474.html https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00549.html http://www.mandriva.com/security/advisories?name=MDVSA-2008:009 https://bugzilla.redhat.com/show_bug.cgi?id=410031 http://osvdb.org/40441 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10158 http://www.redhat.com/support/errata/RHSA-2007-1128.html http://www.redhat.com/support/errata/RHSA-2007-1129.html http://securitytracker.com/id?1019087 http://secunia.com/advisories/28052 http://secunia.com/advisories/28097 http://secunia.com/advisories/28456 Common Vulnerability Exposure (CVE) ID: CVE-2007-6285 BugTraq ID: 26970 http://www.securityfocus.com/bid/26970 https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00726.html https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00732.html https://bugzilla.redhat.com/show_bug.cgi?id=426218 http://osvdb.org/40442 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11457 RedHat Security Advisories: RHSA-2007:1176 http://rhn.redhat.com/errata/RHSA-2007-1176.html RedHat Security Advisories: RHSA-2007:1177 http://rhn.redhat.com/errata/RHSA-2007-1177.html http://securitytracker.com/id?1019137 http://secunia.com/advisories/28156 http://secunia.com/advisories/28168 XForce ISS Database: autofs-hostsmap-weak-securtiy(39188) https://exchange.xforce.ibmcloud.com/vulnerabilities/39188
Copyright	Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 99761 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.