VDB
CVE-2011-2709
CVE-2011-2709
PUBLISHED
CVSS 6.199999809265137 MEDIUM
libgssapi and libgssglue before 0.4 do not properly check privileges, which allows local users to load untrusted configuration files and execute arbitrary code via the GSSAPI_MECH_CONF environment variable, as demonstrated using mount.nfs.
EPSS 0.44% · 37.2th percentile
Risk Scores
CVSS 2.0
6.199999809265137
EPSS Score
0.44%
37.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| umich | libgssglue | 0.1, 0.2, 0 |
| umich | libgssapi | 0, 0.2, 0.1 |
Timeline
- Jun 21, 2012 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 22, 2022 EPSS Score
- Jul 15, 2022 EPSS Score
- Sep 7, 2022 EPSS Score
- Oct 30, 2022 EPSS Score
- Dec 22, 2022 EPSS Score
- Feb 14, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 8, 2023 EPSS Score
- Jun 1, 2023 EPSS Score
References
- https://bugzilla.novell.com/show_bug.cgi?id=694598 url
- [oss-security] 20110722 Re: CVE Request -- libgssapi, libgssglue -- Ability to load untrusted configuration file, when loading GSS mechanisms and their definitions during initialization mailing-list
- [oss-security] 20110721 CVE Request -- libgssapi, libgssglue -- Ability to load untrusted configuration file, when loading GSS mechanisms and their definitions during initialization mailing-list
- FEDORA-2012-7971 vendor-advisory
- http://www.openwall.com/lists/oss-security/2011/08/12/10 technical
- http://lwn.net/Alerts/449415/ technical
- http://secunia.com/advisories/45075 advisory
- http://secunia.com/advisories/50785 technical
- http://www.securityfocus.com/bid/48490 technical
- https://nvd.nist.gov/vuln/detail/CVE-2011-2709 advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082072.html url
- http://lwn.net/Alerts/449415 url
- http://secunia.com/advisories/50973 url
- http://www.citi.umich.edu/projects/nfsv4/linux/libgssglue/libgssglue-0.4.tar.gz url