rpc-gssd in nfs-utils before 1.2.8 performs reverse DNS resolution for server names during GSSAPI authentication, which might allow remote attackers to read otherwise-restricted files via DNS spoofing attacks.

nfs-utils receives hereby a LTSS roll-up security and bugfix update.

  - CVE-2013-1923: Allow DNS lookups to be avoided when     determining kerberos identity of server. The     NFS_GSSD_AVOID_DNS sysconfig variable must to be set for     this to take full effect as some installations could be     negatively affected by this change

More bugs have been fixed :

  - Fixed bugs with the info provided by 'showmount -e' not     being updated correctly. (bnc#661493)

  - nfsserver.init: Fix initialization of /var/lib/nfs/state     and run sm-notify at start up time when necessary     (bnc#628887)

  - Increase number of supported krb5 mounts from 32 to 256.
    (bnc#716463)

  - Avoid crash if krb5_init_context fails (bnc#806840)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes a DNS spoofing problem with NFS rpc-gssd.
(CVE-2013-1923)(bnc#813464)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201412-02 (nfs-utils: Information disclosure)

    rpc.gssd in nfs-utils is vulnerable to DNS spoofing due to it depending       on PTR resolution for GSSAPI authentication, allowing for data to be       submitted to a malicious server without the knowledge of the user.
  Impact :

    A remote attacker may be able to obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

This update of nfs-utils includes several bug and security fixes.

  - gssd-reverse-dns-fix: Allow DNS lookups to be avoided     when determining kerberos identity of server. The     GSSD_OPTIONS sysconfig variable is added so that use of     DNS can be enforced for sites that need it. (bnc#813464     CVE-2013-1923)

  - gssd-n.fix: linux-3.7 changed behaviour of gssd lookups     so that 'gssd -n' isn't sufficient to stop the use of     'machine credentials'. This patch add '-N' which stops     the new use as well. Also add GSSD_OPTIONS to sysconfig     so these flags can be set more easily. (bnc#817651)

  - mountd-fix-exporting-of-with-sec-setting.patch Fix bug     when exporting root filesystem with gss security.
    (bnc#809226)

  - mountd-fix-error-check.patch: check for errors with     exporting filesystems correctly (bnc#809226)

  - nfsserver.init: make sure warning about bind= being     deprecated goes to terminal and not into     /run/nfs/bind.mounts (bnc#809226)

This update of nfs-utils fixed a DNS spoofing issue.

Updated nfs-utils packages fix security vulnerability

It was reported that rpc.gssd in nfs-utils is vulnerable to DNS spoofing due to it depending on PTR resolution for GSSAPI authentication. Because of this, if a user where able to poison DNS to a victim's computer, they would be able to trick rpc.gssd into talking to another server (perhaps with less security) than the intended server (with stricter security). If the victim has write access to the second (less secure) server, and the attacker has read access (when they normally might not on the secure server), the victim could write files to that server, which the attacker could obtain (when normally they would not be able to). To the victim this is transparent because the victim's computer asks the KDC for a ticket to the second server due to reverse DNS resolution; in this case Krb5 authentication does not fail because the victim is talking to the correct server (CVE-2013-1923).

This update fixes a DNS spoofing problem with NFS rpc-gssd.
(CVE-2013-1923)(bnc#813464)

This update fixes a DNS spoofing problem with NFS rpc-gssd.
(CVE-2013-1923)(bnc#813464) It also adds MOUNTD_OPTIONS and GSSD_OPTIONS to /etc/sysconfig/nfs. (bnc#818094, bnc#816897)

ID	Name	Product	Family	Severity
83600	SUSE SLES10 Security Update : nfs-utils (SUSE-SU-2013:1668-1)	Nessus	SuSE Local Security Checks	low
83583	SUSE SLED10 / SLES10 Security Update : nfs-utils (SUSE-SU-2013:0822-1)	Nessus	SuSE Local Security Checks	low
79812	GLSA-201412-02 : nfs-utils: Information disclosure	Nessus	Gentoo Local Security Checks	low
75034	openSUSE Security Update : nfs-utils (openSUSE-SU-2013:1016-1)	Nessus	SuSE Local Security Checks	low
75026	openSUSE Security Update : nfs-utils (openSUSE-SU-2013:1012-1)	Nessus	SuSE Local Security Checks	low
66978	Mandriva Linux Security Advisory : nfs-utils (MDVSA-2013:178)	Nessus	Mandriva Local Security Checks	low
66553	SuSE 10 Security Update : nfs-utils (ZYPP Patch Number 8569)	Nessus	SuSE Local Security Checks	low
66552	SuSE 11.2 Security Update : nfs-client (SAT Patch Number 7717)	Nessus	SuSE Local Security Checks	low

Detections

Analytics

CVE-2013-1923

high

Tenable Plugins

low

low

low

low

low

low

low

low