NVD

Id
4373  
Name
CVE-2008-4552  
Description
The good_client function in nfs-utils 1.0.9, and possibly other versions before 1.1.3, invokes the hosts_ctl function with the wrong order of arguments, which causes TCP Wrappers to ignore netgroups and allows remote attackers to bypass intended access restrictions.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-03  
Published
2008-10-14  
Modified Date
2013-01-22  
Seq
2008-4552  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
27622 4373 CVE-2008-4552 [security-announce] 20100303 VMSA-2010-0004 ESX Service Console and vMA third party updates  View
27623 4373 CVE-2008-4552 oval:org.mitre.oval:def:11544  View
27624 4373 CVE-2008-4552 oval:org.mitre.oval:def:8325  View
27625 4373 CVE-2008-4552 http://wiki.rpath.com/Advisories:rPSA-2008-0307  View
27626 4373 CVE-2008-4552 MDVSA-2009:060  View
27627 4373 CVE-2008-4552 [oss-security] 20120719 CVE Request: quota: incorrect use of tcp_wrappers  View
27628 4373 CVE-2008-4552 [oss-security] 20120719 Re: CVE Request: quota: incorrect use of tcp_wrappers  View
27629 4373 CVE-2008-4552 RHSA-2009:1321  View
27630 4373 CVE-2008-4552 20081030 rPSA-2008-0307-1 nfs-client nfs-server nfs-utils  View
27631 4373 CVE-2008-4552 31823  View
27632 4373 CVE-2008-4552 USN-687-1  View
27633 4373 CVE-2008-4552 ADV-2010-0528  View
27634 4373 CVE-2008-4552 nfsutils-hostctl-security-bypass(45895)  View
27635 4373 CVE-2008-4552 https://bugzilla.redhat.com/show_bug.cgi?id=458676  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
47111 JVNDB-2008-002421 nfs-utils における TCP Wrapper に関するアクセス制限を回避される脆弱性 nfs-utils には、hosts_ctl 関数を呼び出す際に、誤った順序で引数を渡すことで、TCP Wrapper が netgroups を無視するため、アクセス制限を回避可能な脆弱性が存在します。 CVE-2008-4552 34665 CVE-2008-4552 4373 7.5 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-002421.html 2008-10-14 2009-10-09 View