Fedora 8 : autofs-5.0.2-20 (2007-4532)

This script is Copyright (C) 2007-2015 Tenable Network Security, Inc.

Synopsis :

The remote Fedora host is missing a security update.

Description :

- Thu Dec 13 2007 Ian Kent <ikent at redhat.com> -

- Bug 409701: CVE-2007-5964 Privilege Escalation (from
local system) through /net autofs mount configuration

- use mount option 'nosuid' for '-hosts' map unless
'suid' is explicily specified.

- Tue Nov 20 2007 Ian Kent <ikent at redhat.com> -

- fix schema selection in LDAP schema discovery.

- check for '*' when looking up wildcard in LDAP.

- fix couple of edge case parse fails of timeout option.

- add SEARCH_BASE configuration option.

- add random selection as a master map entry option.

- re-read config on HUP signal.

configuration options.

- fix deadlock in submount mount module.

- fix lack of ferror() checking when reading files.

- fix typo in autofs(5) man page.

- fix map entry expansion when undefined macro is

- remove unused export validation code.

- add dynamic logging (adapted from v4 patch from Jeff

- fix recursive loopback mounts (Matthias Koenig).

- add map re-load to verbose logging.

- fix handling of LDAP base dns with spaces.

- handle MTAB_NOTUPDATED status return from mount.

- when default master map, auto.master, is used also
check for auto_master.

- update negative mount timeout handling.

- fix large group handling (Ryan Thomas).

- fix for dynamic logging breaking non-sasl build
(Guillaume Rousse).

- eliminate NULL proc ping for singleton host or local

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

See also :


Solution :

Update the affected autofs and / or autofs-debuginfo packages.

Risk factor :

Medium / CVSS Base Score : 6.9
CVSS Temporal Score : 6.0
Public Exploit Available : true

Family: Fedora Local Security Checks

Nessus Plugin ID: 29715 (fedora_2007-4532.nasl)

Bugtraq ID: 26841

CVE ID: CVE-2007-5964

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now