Bug 25608 - nfs-utils security update (CVE-2019-3689) : /var/lib/nfs/ is owned by statd ; if this is compromised, root access is possible
Summary: nfs-utils security update (CVE-2019-3689) : /var/lib/nfs/ is owned by statd ;...
Status: RESOLVED INVALID
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: Guillaume Rousse
QA Contact: Sec team
URL: https://linuxsecurity.com/advisories/...
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-10-24 18:10 CEST by Zombie Ryushu
Modified: 2019-10-27 17:14 CET (History)
1 user (show)

See Also:
Source RPM: nfs-utils-2.3.4-3.mga7.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Zombie Ryushu 2019-10-24 18:10:35 CEST 
Package        : nfs-utils
Version        : 1.2.8-9+deb8u1
CVE ID         : CVE-2019-3689
Debian Bug     : 940848


In the nfs-utils package, providing support files for Network File
System (NFS) including the rpc.statd daemon, the directory
/var/lib/nfs is owned by statd:nogroup.  This directory contains files
owned and managed by root.  If statd is compromised, it can therefore
trick processes running with root privileges into creating/overwriting
files anywhere on the system.

For Debian 8 "Jessie", this problem has been fixed in version
1.2.8-9+deb8u1.

We recommend that you upgrade your nfs-utils packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Zombie Ryushu 2019-10-24 18:56:21 CEST

Summary: Debian LTS: DLA-1965-1: nfs-utils security update => Debian LTS: DLA-1965-1: nfs-utils security update (CVE-2019-3689)

Comment 1 Lewis Smith 2019-10-24 22:00:10 CEST 
Thank you for drawing this to our attention.
Bug title is re Debian LTS: DLA-1965-1

Assigning to Guillaume for nfs-utils, CC DavidW for security.

Summary: Debian LTS: DLA-1965-1: nfs-utils security update (CVE-2019-3689) => nfs-utils security update (CVE-2019-3689) : /var/lib/nfs/ is owned by statd ; if this is compromised, root access is possible
Component: RPM Packages => Security
CC: (none) => luigiwalser
QA Contact: (none) => security
Source RPM: nfs-utils => nfs-utils-2.3.4-3.mga7.src.rpm

Lewis Smith 2019-10-24 22:01:24 CEST

Assignee: bugsquad => guillomovitch

Comment 2 David Walser 2019-10-27 17:03:25 CET 
Zombie, please provide a link to the advisory and don't copy and paste the text.

Lewis, I am the security group, so I already get the e-mails.  You don't need to CC me.
Comment 3 David Walser 2019-10-27 17:14:09 CET 
Advisory link from October 19:
https://www.debian.org/lts/security/2019/dla-1965

This is a Debian-specific issue.

Resolution: (none) => INVALID
Status: NEW => RESOLVED
Note You need to log in before you can comment on or make changes to this bug.