« Volver al listado

CVE-2011-2709

Estado: ModificadaMedia (6.2)—

libgssapi and libgssglue before 0.4 do not properly check privileges, which allows local users to load untrusted configuration files and execute arbitrary code via the GSSAPI_MECH_CONF environment variable, as demonstrated using mount.nfs.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Umich — LibgssapiUmich — Libgssglue

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2011-2709",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "HIGH",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 1.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2012-06-21T15:55:10.347",
  "references": [
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082072.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082297.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lwn.net/Alerts/449415/",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/45075",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/50785",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/50973",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.citi.umich.edu/projects/nfsv4/linux/libgssglue/libgssglue-0.4.tar.gz",
      "tags": [
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2011/07/21/3",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2011/07/22/4",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2011/08/12/10",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/48490",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.novell.com/show_bug.cgi?id=694598",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082072.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082297.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lwn.net/Alerts/449415/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/45075",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/50785",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/50973",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.citi.umich.edu/projects/nfsv4/linux/libgssglue/libgssglue-0.4.tar.gz",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2011/07/21/3",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2011/07/22/4",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2011/08/12/10",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/48490",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.novell.com/show_bug.cgi?id=694598",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "libgssapi and libgssglue before 0.4 do not properly check privileges, which allows local users to load untrusted configuration files and execute arbitrary code via the GSSAPI_MECH_CONF environment variable, as demonstrated using mount.nfs."
    },
    {
      "lang": "es",
      "value": "libgssapi y libgssglue antes de v0.4 no comprueba correctamente los privilegios, lo que permite cargar archivos de configuración no confiables a usuarios locales y ejecutar código de su elección a través de la variable de entorno GSSAPI_MECH_CONF, como se ha demostrado utilizando mount.nfs."
    }
  ],
  "lastModified": "2026-06-16T23:31:50.583",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:umich:libgssglue:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A99E8102-9FD5-4E76-AFFE-F288A39E69EA",
              "versionEndIncluding": "0.3"
            },
            {
              "criteria": "cpe:2.3:a:umich:libgssglue:0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F6BF044B-AEAE-466E-85F4-56189E1D20BF"
            },
            {
              "criteria": "cpe:2.3:a:umich:libgssglue:0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "00C99322-444D-4DE0-BE28-A19A27490B79"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:umich:libgssapi:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "64EEA101-71A3-4A16-87B6-F9E7D8B1BD21",
              "versionEndIncluding": "0.3"
            },
            {
              "criteria": "cpe:2.3:a:umich:libgssapi:0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7159CB27-5C35-4774-9815-8CF32DB4B11F"
            },
            {
              "criteria": "cpe:2.3:a:umich:libgssapi:0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AA127D0D-7031-45E9-A513-CCF435C424FA"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}