CVE-2011-2709

MEDIUM 6.2CVE-2011-2709 · Published 21/06/2012 · updated 16/06/2026

In short

CVE-2011-2709 is a MEDIUM (CVSS 6.2) vulnerability affecting libgssapi (umich), libgssglue (umich).
Chance of exploitation in the next 30 days (EPSS): 0.44%, higher than 38.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
libgssapi umich	`= 0.1= 0.2≤ 0.3`	No fix yet
libgssglue umich	`= 0.1= 0.2≤ 0.3`	No fix yet

Description

libgssapi and libgssglue before 0.4 do not properly check privileges, which allows local users to load untrusted configuration files and execute arbitrary code via the GSSAPI_MECH_CONF environment variable, as demonstrated using mount.nfs.

References

lists.fedoraproject.org/pipermail/package-announce/2012-June/082072.html
lists.fedoraproject.org/pipermail/package-announce/2012-June/082297.html
lwn.net/Alerts/449415
secunia.com/advisories/45075 · Vendor Advisory
secunia.com/advisories/50785
secunia.com/advisories/50973
citi.umich.edu/projects/nfsv4/linux/libgssglue/libgssglue-0.4.tar.gz · Patch
openwall.com/lists/oss-security/2011/07/21/3
openwall.com/lists/oss-security/2011/07/22/4
openwall.com/lists/oss-security/2011/08/12/10
securityfocus.com/bid/48490
bugzilla.novell.com/show_bug.cgi

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free