CVE-2008-4552 Auth bypass in n/a
Remote attackers can bypass intended access restrictions in NFS utilities due to incorrect argument ordering in TCP Wrappers integration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2008-4552?
CVE-2008-4552 is a high-severity authentication bypass vulnerability in n/a, published on 14 Oct 2008. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The good_client function in nfs-utils 1.0.9, and possibly other versions before 1.1.3, invokes the hosts_ctl function with the wrong order of arguments, which causes TCP Wrappers to ignore netgroups and allows remote attackers to bypass intended access restrictions.
Weakness: CWE-264
Which versions are affected by CVE-2008-4552?
It affects 1 product.
Linux distribution packages (4)
nfs-utils Red Hat:enterprise_linux:5::client | All versions | 1:1.0.9-42.el5 |
nfs-utils-debuginfo Red Hat:enterprise_linux:5::client | All versions | 1:1.0.9-42.el5 |
nfs-utils Red Hat:enterprise_linux:5::server | All versions | 1:1.0.9-42.el5 |
nfs-utils-debuginfo Red Hat:enterprise_linux:5::server | All versions | 1:1.0.9-42.el5 |
Products include Nfs Nfs-Utils.
How do I fix CVE-2008-4552?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2008-4552 being exploited?
There is no known exploitation of CVE-2008-4552 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2008-4552, GHSA-jg64-hjmp-ccvg, RHSA-2009:1321.