CVE-2009-1072
3.7 Low
AI Score
Confidence
High
4.9 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
COMPLETE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:N/I:C/A:N
0.969 High
EPSS
Percentile
99.7%
nfsd in the Linux kernel before 2.6.28.9 does not drop the CAP_MKNOD capability before handling a user request in a thread, which allows local users to create device nodes, as demonstrated on a filesystem that has been exported with the root_squash option.
References
git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=76a67ec6fb79ff3570dcb5342142c16098299911
lists.opensuse.org/opensuse-security-announce/2009-04/msg00007.html
lists.opensuse.org/opensuse-security-announce/2009-05/msg00002.html
lists.opensuse.org/opensuse-security-announce/2009-06/msg00000.html
lists.opensuse.org/opensuse-security-announce/2009-06/msg00001.html
secunia.com/advisories/34422
secunia.com/advisories/34432
secunia.com/advisories/34786
secunia.com/advisories/35121
secunia.com/advisories/35185
secunia.com/advisories/35343
secunia.com/advisories/35390
secunia.com/advisories/35394
secunia.com/advisories/35656
secunia.com/advisories/37471
thread.gmane.org/gmane.linux.kernel/805280
www.debian.org/security/2009/dsa-1800
www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.9
www.openwall.com/lists/oss-security/2009/03/23/1
www.redhat.com/support/errata/RHSA-2009-1081.html
www.securityfocus.com/archive/1/507985/100/0/threaded
www.securityfocus.com/bid/34205
www.ubuntu.com/usn/usn-793-1
www.vmware.com/security/advisories/VMSA-2009-0016.html
www.vupen.com/english/advisories/2009/0802
www.vupen.com/english/advisories/2009/3316
exchange.xforce.ibmcloud.com/vulnerabilities/49356
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10314
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8382
Social References
More
Related
3.7 Low
AI Score
Confidence
High
4.9 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
COMPLETE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:N/I:C/A:N
0.969 High
EPSS
Percentile
99.7%