CVE-2007-6285

2007-12-2022:46:00

Debian Security Bug Tracker

security-tracker.debian.org

6.2 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:H/Au:N/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

10.1%

JSON

The default configuration for autofs 5 (autofs5) in some Linux distributions, such as Red Hat Enterprise Linux (RHEL) 4 and 5, does not specify the nodev mount option for the -hosts map, which allows local users to access “important devices” by operating a remote NFS server and creating special device files on that server, as demonstrated by the /dev/mem device.

OSVersionArchitecturePackageVersionFilename
Debian12allautofs< 5.1.8-2+deb12u2autofs_5.1.8-2+deb12u2_all.deb
Debian11allautofs< 5.1.7-1+deb11u2autofs_5.1.7-1+deb11u2_all.deb
Debian999allautofs< 5.1.9-1.1autofs_5.1.9-1.1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	autofs	< 5.1.8-2+deb12u2	autofs_5.1.8-2+deb12u2_all.deb
Debian	11	all	autofs	< 5.1.7-1+deb11u2	autofs_5.1.7-1+deb11u2_all.deb
Debian	999	all	autofs	< 5.1.9-1.1	autofs_5.1.9-1.1_all.deb