The good_client function in nfs-utils 1.0.9, and possibly other versions before 1.1.3, invokes the hosts_ctl function with the wrong order of arguments, which causes TCP Wrappers to ignore netgroups and allows remote attackers to bypass intended access restrictions.

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2009-1321 advisory.

    [1.0.9-42 ]
    - mountd: Check host alias with netgroups (bz 478952)
    - exportfs: fixed typo in man page (bz 474848)
    - nfs.init: NFS server reboot results in 'Stale NFS file handle' (bz 474449)
    - nfslock.init: options not correctly parsed (bz 459591)
    - mount.nfs: mounts fail with read-only /etc (bz 450646)
    - nfslock.init: lockd not using settings in sysconfig/nfs (bz 434795)
    - tcpwrappers: updated code to correctly use api  (bz 494878)
    - nhfsstone: added v3 and v4 support (bz 465933)
    - mount.nfs: add support for lookupcache= option (bz 489335).

    [1.0.9-41]
    - clarify 'mount request from unknown host' log message from mountd (bz 463578)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote VMware ESX host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries :

  - bind
  - expat
  - glib2
  - Kernel
  - newt
  - nfs-utils
  - NTP
  - OpenSSH
  - OpenSSL

It was discovered that nfs-utils did not use tcp_wrappers correctly.
Certain hosts access rules defined in '/etc/hosts.allow' and '/etc/hosts.deny' may not have been honored, possibly allowing remote attackers to bypass intended access restrictions. (CVE-2008-4552)

This updated package also fixes the following bugs :

  - the 'LOCKD_TCPPORT' and 'LOCKD_UDPPORT' options in     '/etc/sysconfig/nfs' were not honored: the lockd daemon     continued to use random ports. With this update, these     options are honored. (BZ#434795)

  - it was not possible to mount NFS file systems from a     system that has the '/etc/' directory mounted on a     read-only file system (this could occur on systems with     an NFS-mounted root file system). With this update, it     is possible to mount NFS file systems from a system that     has '/etc/' mounted on a read-only file system.
    (BZ#450646)

  - arguments specified by 'STATDARG=' in     '/etc/sysconfig/nfs' were removed by the nfslock init     script, meaning the arguments specified were never     passed to rpc.statd. With this update, the nfslock init     script no longer removes these arguments. (BZ#459591)

  - when mounting an NFS file system from a host not     specified in the NFS server's '/etc/exports' file, a     misleading 'unknown host' error was logged on the server     (the hostname lookup did not fail). With this update, a     clearer error message is provided for these situations.
    (BZ#463578)

  - the nhfsstone benchmark utility did not work with NFS     version 3 and 4. This update adds support to nhfsstone     for NFS version 3 and 4. The new nhfsstone '-2', '-3',     and '-4' options are used to select an NFS version     (similar to nfsstat(8)). (BZ#465933)

  - the exportfs(8) manual page contained a spelling     mistake, 'djando', in the EXAMPLES section. (BZ#474848)

  - in some situations the NFS server incorrectly refused     mounts to hosts that had a host alias in a NIS netgroup.
    (BZ#478952)

  - in some situations the NFS client used its cache, rather     than using the latest version of a file or directory     from a given export. This update adds a new mount     option, 'lookupcache=', which allows the NFS client to     control how it caches files and directories. Note: The     Scientific Linux 2.6.18-164 or later kernel update must     be installed in order to use the 'lookupcache=' option.
    Also, 'lookupcache=' is currently only available for NFS     version 3. Support for NFS version 4 may be introduced     in future Scientific Linux 5 updates. (BZ#489335)

After installing this update, the nfs service will be restarted automatically.

Note: This update is already in SL 5.4

a. vMA and Service Console update for newt to 0.52.2-12.el5_4.1

   Newt is a programming library for color text mode, widget based    user interfaces. Newt can be used to add stacked windows, entry    widgets, checkboxes, radio buttons, labels, plain text fields,    scrollbars, etc., to text mode user interfaces.

   A heap-based buffer overflow flaw was found in the way newt    processes content that is to be displayed in a text dialog box.
   A local attacker could issue a specially crafted text dialog box    display request (direct or via a custom application), leading to a    denial of service (application crash) or, potentially, arbitrary    code execution with the privileges of the user running the    application using the newt library.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-2905 to this issue.

b. vMA and Service Console update for vMA package nfs-utils to    1.0.9-42.el5

   The nfs-utils package provides a daemon for the kernel NFS server    and related tools.

   It was discovered that nfs-utils did not use tcp_wrappers    correctly.  Certain hosts access rules defined in '/etc/hosts.allow'    and '/etc/hosts.deny' may not have been honored, possibly allowing    remote attackers to bypass intended access restrictions.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2008-4552 to this issue.

c. vMA and Service Console package glib2 updated to 2.12.3-4.el5_3.1

   GLib is the low-level core library that forms the basis for    projects such as GTK+ and GNOME. It provides data structure    handling for C, portability wrappers, and interfaces for such    runtime functionality as an event loop, threads, dynamic loading,    and an object system.

   Multiple integer overflows in glib/gbase64.c in GLib before 2.20    allow context-dependent attackers to execute arbitrary code via a    long string that is converted either from or to a base64    representation.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2008-4316 to this issue.

d. vMA and Service Console update for openssl to 0.9.8e-12.el5

   SSL is a toolkit implementing SSL v2/v3 and TLS protocols with full-    strength cryptography world-wide.

   Multiple denial of service flaws were discovered in OpenSSL's DTLS    implementation. A remote attacker could use these flaws to cause a    DTLS server to use excessive amounts of memory, or crash on an    invalid memory access or NULL pointer dereference.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the names CVE-2009-1377, CVE-2009-1378,    CVE-2009-1379, CVE-2009-1386, CVE-2009-1387 to these issues.

   An input validation flaw was found in the handling of the BMPString    and UniversalString ASN1 string types in OpenSSL's    ASN1_STRING_print_ex() function. An attacker could use this flaw to    create a specially crafted X.509 certificate that could cause    applications using the affected function to crash when printing    certificate contents.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-0590 to this issue.

e. vMA and Service Console package bind updated to 9.3.6-4.P1.el5_4.1

   It was discovered that BIND was incorrectly caching responses    without performing proper DNSSEC validation, when those responses    were received during the resolution of a recursive client query    that requested DNSSEC records but indicated that checking should be    disabled. A remote attacker could use this flaw to bypass the DNSSEC    validation check and perform a cache poisoning attack if the target    BIND server was receiving such client queries.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-4022 to this issue.

f. vMA and Service Console package expat updated to 1.95.8-8.3.el5_4.2.

   Two buffer over-read flaws were found in the way Expat handled    malformed UTF-8 sequences when processing XML files. A specially-    crafted XML file could cause applications using Expat to fail while    parsing the file.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the names CVE-2009-3560 and CVE-2009-3720 to these    issues.

g. vMA and Service Console package openssh update to 4.3p2-36.el5_4.2

   A Red Hat specific patch used in the openssh packages as shipped in    Red Hat Enterprise Linux 5.4 (RHSA-2009:1287) loosened certain    ownership requirements for directories used as arguments for the    ChrootDirectory configuration options. A malicious user that also    has or previously had non-chroot shell access to a system could    possibly use this flaw to escalate their privileges and run    commands as any system user.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-2904 to this issue.

h. vMA and Service Console package ntp updated to    ntp-4.2.2p1-9.el5_4.1.i386.rpm

   A flaw was discovered in the way ntpd handled certain malformed NTP    packets. ntpd logged information about all such packets and replied    with an NTP packet that was treated as malformed when received by    another ntpd. A remote attacker could use this flaw to create an NTP    packet reply loop between two ntpd servers through a malformed packet    with a spoofed source IP address and port, causing ntpd on those    servers to use excessive amounts of CPU time and fill disk space with    log messages.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-3563 to this issue.   

i. vMA update for package kernel to 2.6.18-164.9.1.el5

   Updated vMA package kernel addresses the security issues listed    below.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2009-2849 to the security issue fixed in    kernel 2.6.18-128.2.1

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2009-2695, CVE-2009-2908, CVE-2009-3228,    CVE-2009-3286, CVE-2009-3547, CVE-2009-3613 to the security issues    fixed in kernel 2.6.18-128.6.1

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2009-3612, CVE-2009-3620, CVE-2009-3621,    CVE-2009-3726 to the security issues fixed in kernel    2.6.18-128.9.1

j. vMA 4.0 updates for the packages kpartx, libvolume-id,    device-mapper-multipath, fipscheck, dbus, dbus-libs, and ed

   kpartx updated to 0.4.7-23.el5_3.4, libvolume-id updated to    095-14.20.el5 device-mapper-multipath package updated to    0.4.7-23.el5_3.4, fipscheck updated to 1.0.3-1.el5, dbus    updated to 1.1.2-12.el5, dbus-libs updated to 1.1.2-12.el5,    and ed package updated to 0.2-39.el5_2.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the names CVE-2008-3916, CVE-2009-1189 and    CVE-2009-0115 to these issues.

An updated nfs-utils package that fixes a security issue and several bugs is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The nfs-utils package provides a daemon for the kernel NFS server and related tools.

It was discovered that nfs-utils did not use tcp_wrappers correctly.
Certain hosts access rules defined in '/etc/hosts.allow' and '/etc/hosts.deny' may not have been honored, possibly allowing remote attackers to bypass intended access restrictions. (CVE-2008-4552)

This updated package also fixes the following bugs :

* the 'LOCKD_TCPPORT' and 'LOCKD_UDPPORT' options in '/etc/sysconfig/nfs' were not honored: the lockd daemon continued to use random ports. With this update, these options are honored.
(BZ#434795)

* it was not possible to mount NFS file systems from a system that has the '/etc/' directory mounted on a read-only file system (this could occur on systems with an NFS-mounted root file system). With this update, it is possible to mount NFS file systems from a system that has '/etc/' mounted on a read-only file system. (BZ#450646)

* arguments specified by 'STATDARG=' in '/etc/sysconfig/nfs' were removed by the nfslock init script, meaning the arguments specified were never passed to rpc.statd. With this update, the nfslock init script no longer removes these arguments. (BZ#459591)

* when mounting an NFS file system from a host not specified in the NFS server's '/etc/exports' file, a misleading 'unknown host' error was logged on the server (the hostname lookup did not fail). With this update, a clearer error message is provided for these situations.
(BZ#463578)

* the nhfsstone benchmark utility did not work with NFS version 3 and 4. This update adds support to nhfsstone for NFS version 3 and 4. The new nhfsstone '-2', '-3', and '-4' options are used to select an NFS version (similar to nfsstat(8)). (BZ#465933)

* the exportfs(8) manual page contained a spelling mistake, 'djando', in the EXAMPLES section. (BZ#474848)

* in some situations the NFS server incorrectly refused mounts to hosts that had a host alias in a NIS netgroup. (BZ#478952)

* in some situations the NFS client used its cache, rather than using the latest version of a file or directory from a given export. This update adds a new mount option, 'lookupcache=', which allows the NFS client to control how it caches files and directories. Note: The Red Hat Enterprise Linux 5.4 kernel update (the fourth regular update) must be installed in order to use the 'lookupcache=' option. Also, 'lookupcache=' is currently only available for NFS version 3. Support for NFS version 4 may be introduced in future Red Hat Enterprise Linux 5 updates. Refer to Red Hat Bugzilla #511312 for further information.
(BZ#489335)

Users of nfs-utils should upgrade to this updated package, which contains backported patches to correct these issues. After installing this update, the nfs service will be restarted automatically.

This update of nfs-utils fixes the handling of the tcp wrapper ACLs.
(CVE-2008-4552)

The remote Redhat Enterprise Linux 5 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2009:1321 advisory.

    The nfs-utils package provides a daemon for the kernel NFS server and     related tools.

    It was discovered that nfs-utils did not use tcp_wrappers correctly.
    Certain hosts access rules defined in /etc/hosts.allow and     /etc/hosts.deny may not have been honored, possibly allowing remote     attackers to bypass intended access restrictions. (CVE-2008-4552)

    This updated package also fixes the following bugs:

    * the LOCKD_TCPPORT and LOCKD_UDPPORT options in /etc/sysconfig/nfs     were not honored: the lockd daemon continued to use random ports. With this     update, these options are honored. (BZ#434795)

    * it was not possible to mount NFS file systems from a system that has     the /etc/ directory mounted on a read-only file system (this could occur     on systems with an NFS-mounted root file system). With this update, it is     possible to mount NFS file systems from a system that has /etc/ mounted     on a read-only file system. (BZ#450646)

    * arguments specified by STATDARG= in /etc/sysconfig/nfs were removed     by the nfslock init script, meaning the arguments specified were never     passed to rpc.statd. With this update, the nfslock init script no longer     removes these arguments. (BZ#459591)

    * when mounting an NFS file system from a host not specified in the NFS     server's /etc/exports file, a misleading unknown host error was logged     on the server (the hostname lookup did not fail). With this update, a     clearer error message is provided for these situations. (BZ#463578)

    * the nhfsstone benchmark utility did not work with NFS version 3 and 4.
    This update adds support to nhfsstone for NFS version 3 and 4. The new     nhfsstone -2, -3, and -4 options are used to select an NFS version     (similar to nfsstat(8)). (BZ#465933)

    * the exportfs(8) manual page contained a spelling mistake, djando, in     the EXAMPLES section. (BZ#474848)

    * in some situations the NFS server incorrectly refused mounts to hosts     that had a host alias in a NIS netgroup. (BZ#478952)

    * in some situations the NFS client used its cache, rather than using     the latest version of a file or directory from a given export. This update     adds a new mount option, lookupcache=, which allows the NFS client to     control how it caches files and directories. Note: The Red Hat Enterprise     Linux 5.4 kernel update (the fourth regular update) must be installed in     order to use the lookupcache= option. Also, lookupcache= is currently     only available for NFS version 3. Support for NFS version 4 may be     introduced in future Red Hat Enterprise Linux 5 updates. Refer to Red Hat     Bugzilla #511312 for further information. (BZ#489335)

    Users of nfs-utils should upgrade to this updated package, which contains     backported patches to correct these issues. After installing this update,     the nfs service will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A security vulnerability has been identified and fixed in nfs-utils, which caused TCP Wrappers to ignore netgroups and allows remote attackers to bypass intended access restrictions (CVE-2008-4552).

The updated packages have been patched to prevent this.

It was discovered that nfs-utils did not properly enforce netgroup restrictions when using TCP Wrappers. Remote attackers could bypass the netgroup restrictions enabled by the administrator and possibly gain access to sensitive information.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200903-06 (nfs-utils: Access restriction bypass)

    Michele Marcionelli reported that nfs-utils invokes the hosts_ctl()     function with the wrong order of arguments, which causes TCP Wrappers     to ignore netgroups.
  Impact :

    A remote attacker could bypass intended access restrictions, i.e. NFS     netgroups, and gain access to restricted services.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
180604	Oracle Linux 5 : nfs-utils (ELSA-2009-1321)	Nessus	Oracle Linux Local Security Checks	critical
89737	VMware ESX Third-Party Libraries Multiple Vulnerabilities (VMSA-2010-0004) (remote check)	Nessus	VMware ESX Local Security Checks	high
60656	Scientific Linux Security Update : nfs-utils on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
44993	VMSA-2010-0004 : ESX Service Console and vMA third-party updates	Nessus	VMware ESX Local Security Checks	high
43784	CentOS 5 : nfs-utils (CESA-2009:1321)	Nessus	CentOS Local Security Checks	high
41564	SuSE 10 Security Update : nfs-utils (ZYPP Patch Number 5713)	Nessus	SuSE Local Security Checks	high
41250	SuSE9 Security Update : nfs-utils (YOU Patch Number 12274)	Nessus	SuSE Local Security Checks	high
40838	RHEL 5 : nfs-utils (RHSA-2009:1321)	Nessus	Red Hat Local Security Checks	critical
37261	Mandriva Linux Security Advisory : nfs-utils (MDVSA-2009:060)	Nessus	Mandriva Local Security Checks	high
36927	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : nfs-utils vulnerability (USN-687-1)	Nessus	Ubuntu Local Security Checks	high
35796	GLSA-200903-06 : nfs-utils: Access restriction bypass	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2008-4552

critical

Tenable Plugins

critical

high

high

high

high

high

high

critical

high

high

high