NVD

Id
9445  
Name
CVE-2011-2709  
Description
libgssapi and libgssglue before 0.4 do not properly check privileges, which allows local users to load untrusted configuration files and execute arbitrary code via the GSSAPI_MECH_CONF environment variable, as demonstrated using mount.nfs.  
Reject
 
CVSS Version
2  
CVSS Score
6.2  
Severity
Medium  
CVSS Base Score
6.2  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
1.9  
CVSS Vector
(AV:L/AC:H/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-07  
Published
2012-06-21  
Modified Date
2013-03-01  
Seq
2011-2709  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
53945 9445 CVE-2011-2709 FEDORA-2012-8067  View
53946 9445 CVE-2011-2709 FEDORA-2012-7971  View
53947 9445 CVE-2011-2709 SUSE-SU-2011:0696  View
53948 9445 CVE-2011-2709 http://www.citi.umich.edu/projects/nfsv4/linux/libgssglue/libgssglue-0.4.tar.gz  View
53949 9445 CVE-2011-2709 [oss-security] 20110721 CVE Request -- libgssapi, libgssglue -- Ability to load untrusted configuration file, when loading GSS mechanisms and their definitions during initialization  View
53950 9445 CVE-2011-2709 [oss-security] 20110722 Re: CVE Request -- libgssapi, libgssglue -- Ability to load untrusted configuration file, when loading GSS mechanisms and their definitions during initialization  View
53951 9445 CVE-2011-2709 [oss-security] 20110812 Re: CVE Request -- libgssapi, libgssglue -- Ability to load untrusted configuration file, when loading GSS mechanisms and their definitions during initialization  View
53952 9445 CVE-2011-2709 48490  View
53953 9445 CVE-2011-2709 https://bugzilla.novell.com/show_bug.cgi?id=694598  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
27134 JVNDB-2012-002841 libgssapi および libgssglue における信頼されていない設定ファイルをロードされる脆弱性 libgssapi および libgssglue は、権限を適切にチェックしないため、信頼されていない設定ファイルをロードされる、または任意のコードを実行される脆弱性が存在します。 CVE-2011-2709 50616 CVE-2011-2709 9445 6.2 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002841.html 2012-06-21 2012-06-25 View