Missing authorization in Linux kernel - CVE-2005-3623
Published: June 20, 2024
Vulnerability identifier: #VU92875
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2005-3623
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
nfs2acl.c in the Linux kernel 2.6.14.4 does not check for MAY_SATTR privilege before setting access controls (ACL) on files on exported NFS filesystems, which allows remote attackers to bypass ACLs for readonly mounted NFS filesystems.
Affected software
Linux kernel
How to mitigate CVE-2005-3623
Install update from vendor's repository.
External References
- http://lkml.org/lkml/2005/12/23/171
- http://www.novell.com/linux/security/advisories/2006_06_kernel.html
- http://secunia.com/advisories/18788
- http://lists.suse.de/archive/suse-security-announce/2006-Feb/0010.html
- http://secunia.com/advisories/19038
- http://www.securityfocus.com/bid/16570
- http://www.redhat.com/support/errata/RHSA-2006-0575.html
- http://secunia.com/advisories/21465
- http://support.avaya.com/elmodocs2/security/ASA-2006-200.htm
- http://secunia.com/advisories/22417
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11707