The default configuration for autofs 5 (autofs5) in some Linux distributions, such as Red Hat Enterprise Linux (RHEL) 4 and 5, does not specify the nodev mount option for the -hosts map, which allows local users to access "important devices" by operating a remote NFS server and creating special device files on that server, as demonstrated by the /dev/mem device.

From Red Hat Security Advisory 2007:1177 :

Updated autofs5 technology preview packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The autofs utility controls the operation of the automount daemon, which automatically mounts file systems when you use them, and unmounts them when you are not using them. This can include network file systems and CD-ROMs. The autofs5 packages were made available as a technology preview in Red Hat Enterprise Linux 4.6.

There was a security issue with the default configuration of autofs version 5, whereby the entry for the '-hosts' map did not specify the 'nodev' mount option. A local user with control of a remote NFS server could create special device files on the remote file system, that if mounted using the default '-hosts' map, could allow the user to access important system devices. (CVE-2007-6285)

This issue is similar to CVE-2007-5964, which fixed a missing 'nosuid' mount option in autofs. Both the 'nodev' and 'nosuid' options should be enabled to prevent a possible compromise of machine integrity.

Due to the fact that autofs always mounted '-hosts' map entries 'dev' by default, autofs has now been altered to always use the 'nodev' option when mounting from the default '-hosts' map. The 'dev' option must be explicitly given in the master map entry to revert to the old behavior. This change affects only the '-hosts' map which corresponds to the '/net' entry in the default configuration.

All autofs5 users are advised to upgrade to these updated packages, which resolve this issue.

Red Hat would like to thank Tim Baum for reporting this issue.

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2007-1176 advisory.

    [5.0.1-0.rc2.55.el5.2]
     - Bug 426219: CVE-2007-6285 autofs default doesn't set nodev in /net      [rhel-5.1.z]
       - use mount option nodev for -hosts map unless dev is explicily      specified.
     - Related: rhbz#426219

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated autofs packages that fix a security issue are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The autofs utility controls the operation of the automount daemon, which automatically mounts file systems when you use them, and unmounts them when you are not using them. This can include network file systems and CD-ROMs.

There was a security issue with the default configuration of autofs version 5, whereby the entry for the '-hosts' map did not specify the 'nodev' mount option. A local user with control of a remote NFS server could create special device files on the remote file system, that if mounted using the default '-hosts' map, could allow the user to access important system devices. (CVE-2007-6285)

This issue is similar to CVE-2007-5964, which fixed a missing 'nosuid' mount option in autofs. Both the 'nodev' and 'nosuid' options should be enabled to prevent a possible compromise of machine integrity.

Due to the fact that autofs always mounted '-hosts' map entries 'dev' by default, autofs has now been altered to always use the 'nodev' option when mounting from the default '-hosts' map. The 'dev' option must be explicitly given in the master map entry to revert to the old behavior. This change affects only the '-hosts' map which corresponds to the '/net' entry in the default configuration.

All autofs users are advised to upgrade to these updated packages, which resolve this issue.

Red Hat would like to thank Tim Baum for reporting this issue.

The default behaviour of autofs 5 for the hosts map did not specify the nosuid and nodev mount options. This could allow a local user with control of a remote NFS server to create a setuid root executable on the exported filesystem of the remote NFS server. If this filesystem was mounted with the default hosts map, it would allow the user to obtain root privileges (CVE-2007-5964). Likewise, the same scenario would be available for local users able to create device files on the exported filesystem which could allow the user to gain access to important system devices (CVE-2007-6285).

Because the default behaviour of autofs was to mount -hosts map entries with the dev and suid options enabled by default, autofs has been altered to always use nodev and nosuid by default. In order to have the old behaviour, the configuration must now explicitly set the dev and/or suid options.

This change only affects the -hosts map which corresponds to the /net entry in the default configuration.

Update :

The previous update shipped with an incorrect LDAP lookup module that would prevent the automount daemon from starting. This update corrects that problem.

Updated autofs5 technology preview packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The autofs utility controls the operation of the automount daemon, which automatically mounts file systems when you use them, and unmounts them when you are not using them. This can include network file systems and CD-ROMs. The autofs5 packages were made available as a technology preview in Red Hat Enterprise Linux 4.6.

There was a security issue with the default configuration of autofs version 5, whereby the entry for the '-hosts' map did not specify the 'nodev' mount option. A local user with control of a remote NFS server could create special device files on the remote file system, that if mounted using the default '-hosts' map, could allow the user to access important system devices. (CVE-2007-6285)

This issue is similar to CVE-2007-5964, which fixed a missing 'nosuid' mount option in autofs. Both the 'nodev' and 'nosuid' options should be enabled to prevent a possible compromise of machine integrity.

Due to the fact that autofs always mounted '-hosts' map entries 'dev' by default, autofs has now been altered to always use the 'nodev' option when mounting from the default '-hosts' map. The 'dev' option must be explicitly given in the master map entry to revert to the old behavior. This change affects only the '-hosts' map which corresponds to the '/net' entry in the default configuration.

All autofs5 users are advised to upgrade to these updated packages, which resolve this issue.

Red Hat would like to thank Tim Baum for reporting this issue.

The remote Redhat Enterprise Linux 5 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2007:1176 advisory.

    The autofs utility controls the operation of the automount daemon, which     automatically mounts file systems when you use them, and unmounts them when     you are not using them. This can include network file systems and CD-ROMs.

    There was a security issue with the default configuration of autofs version     5, whereby the entry for the -hosts map did not specify the nodev mount     option. A local user with control of a remote NFS server could create     special device files on the remote file system, that if mounted using the     default -hosts map, could allow the user to access important system     devices. (CVE-2007-6285)

    This issue is similar to CVE-2007-5964, which fixed a missing nosuid     mount option in autofs. Both the nodev and nosuid options should be     enabled to prevent a possible compromise of machine integrity.

    Due to the fact that autofs always mounted -hosts map entries dev by     default, autofs has now been altered to always use the nodev option when     mounting from the default -hosts map. The dev option must be explicitly     given in the master map entry to revert to the old behavior. This change     affects only the -hosts map which corresponds to the /net entry in the     default configuration.

    All autofs users are advised to upgrade to these updated packages, which     resolve this issue.

    Red Hat would like to thank Tim Baum for reporting this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

- Fri Dec 21 2007 Ian Kent <ikent at redhat.com> -     5.0.1-31

    - Bug 426399: CVE-2007-6285 autofs default doesn't set       nodev in /net [f7]

    - use mount option 'nodev' for '-hosts' map unless 'dev'       is explicily specified.

    - Tue Dec 18 2007 Ian Kent <ikent at redhat.com> -       5.0.1-30

    - Bug 397591 SELinux is preventing /sbin/rpc.statd       (rpcd_t) 'search' to <Unknown> (sysctl_fs_t).

    - prevent fork between fd open and setting of       FD_CLOEXEC.

    - Thu Dec 13 2007 Ian Kent <ikent at redhat.com> -       5.0.1-29

    - Bug 421351: CVE-2007-5964 autofs defaults don't       restrict suid in /net [f7]

    - use mount option 'nosuid' for '-hosts' map unless       'suid' is explicily specified.

    - Wed Sep 5 2007 Ian Kent <ikent at redhat.com> -       5.0.1-28

    - add ldaps support (required by schema discovery).

    - add back LDAP schema discovery if no schema is       configured.

    - Tue Aug 28 2007 Ian Kent <ikent at redhat.com> -       5.0.1-26

    - fix 'nosymlink' option handling and add desription to       man page.

    - update patch to prevent failure on empty master map.

    - if there's no 'automount' entry in nsswitch.conf use       'files' source.

    - add LDAP schema discovery if no schema is configured.

    - Tue Aug 21 2007 Ian Kent <ikent at redhat.com> -       5.0.1-25

    - change random multiple server selection option name to       be consistent with upstream naming.

  - Tue Aug 21 2007 Ian Kent <ikent at redhat.com> -     5.0.1-24

    - don't fail on empty master map.

    - allow for older schemas that allow '*' as a key value.

    - add support for the '%' hack for case insensitive       attribute schemas.

    - Mon Jul 30 2007 Ian Kent <ikent at redhat.com> -       5.0.1-23

    - mark map instances stale so they aren't 'cleaned'       during updates.

    - fix large file compile time option.

    - Fri Jul 27 2007 Ian Kent <ikent at redhat.com> -       5.0.1-22

    - fix version passed to get_supported_ver_and_cost (bz       249574).

    - Tue Jul 24 2007 Ian Kent <ikent at redhat.com> -       5.0.1-21

    - fix parse confusion between attribute and attribute       value.

    - Fri Jul 20 2007 Ian Kent <ikent at redhat.com> -       5.0.1-20

    - fix handling of quoted slash alone (bz 248943).

    - Wed Jul 18 2007 Ian Kent <ikent at redhat.com> -       5.0.1-19

    - fix wait time resolution in alarm and state queue       handlers (bz 247711).

    - Mon Jul 16 2007 Ian Kent <ikent at redhat.com> -       5.0.1-18

    - correct man page of patch which added mount options       append control.

    - Mon Jul 16 2007 Ian Kent <ikent at redhat.com> -       5.0.1-17

    - fix mount point directory creation for bind mounts.

    - add quoting for exports gathered by hosts map.

    - Thu Jun 7 2007 Ian Kent <ikent at redhat.com> -       5.0.1-13

    - fix deadlock in alarm manager module.

    - Sun Jun 3 2007 Ian Kent <ikent at redhat.com> -       5.0.1-11

    - correct mistake in logic test in wildcard lookup.

    - Mon May 7 2007 Ian Kent <ikent at redhat.com> -       5.0.1-10

    - fix master map lexer to admit '.' in macro values.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fri Dec 21 2007 Ian Kent <ikent at redhat.com> -     5.0.2-24

    - Bug 426400: CVE-2007-6285 autofs default doesn't set       nodev in /net [f8]

    - use mount option 'nodev' for '-hosts' map unless 'dev'       is explicily specified.

    - Tue Dec 18 2007 Ian Kent <ikent at redhat.com> -       5.0.2-22

    - Bug 397591 SELinux is preventing /sbin/rpc.statd       (rpcd_t) 'search' to <Unknown> (sysctl_fs_t).

    - prevent fork between fd open and setting of       FD_CLOEXEC.

    - Thu Dec 13 2007 Ian Kent <ikent at redhat.com> -       5.0.2-20

    - Bug 409701: CVE-2007-5964 Privilege Escalation (from       local system) through /net autofs mount configuration       bug

    - use mount option 'nosuid' for '-hosts' map unless       'suid' is explicily specified.

    - Tue Nov 20 2007 Ian Kent <ikent at redhat.com> -       5.0.2-17

    - fix schema selection in LDAP schema discovery.

    - check for '*' when looking up wildcard in LDAP.

    - fix couple of edge case parse fails of timeout option.

    - add SEARCH_BASE configuration option.

    - add random selection as a master map entry option.

    - re-read config on HUP signal.

    - add LDAP_URI, LDAP_TIMEOUT and LDAP_NETWORK_TIMEOUT       configuration options.

    - fix deadlock in submount mount module.

    - fix lack of ferror() checking when reading files.

    - fix typo in autofs(5) man page.

    - fix map entry expansion when undefined macro is       present.

    - remove unused export validation code.

    - add dynamic logging (adapted from v4 patch from Jeff       Moyer).

    - fix recursive loopback mounts (Matthias Koenig).

    - add map re-load to verbose logging.

    - fix handling of LDAP base dns with spaces.

    - handle MTAB_NOTUPDATED status return from mount.

    - when default master map, auto.master, is used also       check for auto_master.

    - update negative mount timeout handling.

    - fix large group handling (Ryan Thomas).

    - fix for dynamic logging breaking non-sasl build       (Guillaume Rousse).

    - eliminate NULL proc ping for singleton host or local       mounts.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
67628	Oracle Linux 4 : autofs5 (ELSA-2007-1177)	Nessus	Oracle Linux Local Security Checks	medium
67627	Oracle Linux 5 : Important: / autofs (ELSA-2007-1176)	Nessus	Oracle Linux Local Security Checks	critical
43665	CentOS 5 : autofs (CESA-2007:1176)	Nessus	CentOS Local Security Checks	medium
37526	Mandriva Linux Security Advisory : autofs (MDVSA-2008:009-1)	Nessus	Mandriva Local Security Checks	medium
29778	RHEL 4 : autofs5 (RHSA-2007:1177)	Nessus	Red Hat Local Security Checks	medium
29777	RHEL 5 : autofs (RHSA-2007:1176)	Nessus	Red Hat Local Security Checks	critical
29768	Fedora 7 : autofs-5.0.1-31 (2007-4709)	Nessus	Fedora Local Security Checks	medium
29767	Fedora 8 : autofs-5.0.2-24 (2007-4707)	Nessus	Fedora Local Security Checks	medium
29754	CentOS 4 : autofs5 (CESA-2007:1177)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2007-6285

high

Tenable Plugins

medium

critical

medium

medium

medium

critical

medium

medium

medium