Summary
It was discovered that the nfs-utils package set incorrect permissions on
the /var/lib/nfs directory. An attacker could possibly use this issue to
escalate privileges.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | nfs-utils | 1:1.2.8-9ubuntu12.3 |
| Ubuntu · 18.04 LTS 18.04:LTS | nfs-utils | 1:1.3.4-2.1ubuntu5.3 |
| Ubuntu · 20.04 LTS 20.04:LTS | nfs-utils | 1:1.3.4-2.5ubuntu3.3 |
Vulnerabilities 1
-
Medium 5.1
nfs-utils: root-owned files stored in insecure /var/lib/nfs directory
The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. This directory contains …
References
-
report
https://ubuntu.com/security/CVE-2019-3689