Detections
Analytics
MiracleLinux 7 : autofs-5.0.7-54.el7 (AXSA:2015-744:01)
high Nessus Plugin ID 290094
Synopsis
The remote MiracleLinux host is missing a security update.Description
The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2015-744:01 advisory.autofs is a daemon which automatically mounts filesystems when you use them, and unmounts them later when you are not using them. This can include network filesystems, CD-ROMs, floppies, and so forth.
Security issues fixed with this release:
CVE-2014-8169 automount 5.0.8, when a program map uses certain interpreted languages, uses the calling user's USER and HOME environment variable values instead of the values for the user used to run the mapped program, which allows local users to gain privileges via a Trojan horse program in the user home directory.
Fixed bugs:
* When the ls * command was run in the root of an indirect mount, autofs attempted to literally mount the wildcard character (*) causing it to be added to the negative cache. If done before a valid mount, autofs then failed on further mount attempts inside the mount point, valid or not. This has been fixed, and wildcard map entries now function in the described situation.
* When autofs encountered a syntax error consisting of a duplicate entry in a multimap entry, it reported an error and did not mount the map entry. With this update, autofs has been amended to report the problem in the log to alert the system administrator and use the last seen instance of the duplicate entry rather than fail.
* In the ldap and sss lookup modules, the map reading functions did not distinguish between the no entry found and service not available errors. Consequently, when the service not available response was returned from a master map read, autofs did not update the mounts. An entry not found return does not prevent the map update, so the ldap and sss lookup modules were updated to distinguish between these two returns and now work as expected.
Enhancements:
* The description of the configuration parameter map_hash_table_size was missing from the autofs.conf(5) man page and its description in the configuration file comments was insufficient. A description of the parameter has been added to autofs.conf(5), and the configuration file comments have been updated.
Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Update the affected autofs package.See Also
Plugin Details
Severity: High
ID: 290094
File Name: miracle_linux_AXSA-2015-744.nasl
Version: 1.1
Type: local
Published: 1/16/2026
Updated: 1/16/2026
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
Vendor
Vendor Severity: Moderate
CVSS v2
Risk Factor: Medium
Base Score: 4.4
Temporal Score: 3.3
Vector: CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2014-8169
CVSS v3
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.8
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:miracle:linux:autofs, cpe:/o:miracle:linux:7
Required KB Items: Host/local_checks_enabled, Host/MiracleLinux/release, Host/MiracleLinux/rpm-list, Host/cpu
Exploit Ease: No known exploits are available
Patch Publication Date: 11/24/2015
Vulnerability Publication Date: 2/13/2015
Reference Information
CVE: CVE-2014-8169