Openwall NFS-utils export-import Module Unauth ACL Modification Vulnerability (CVE-2020-7159)

Openwall Vulnerability Summary Vulnerability Overview Vulnerability ID: CVE-2020-7159 Publication Date: October 28, 2020 Description: - Chen Yulong from the Institute of Computing Technology, Chinese Academy of Sciences, reported multiple vulnerabilities in the module. - These vulnerabilities allow unauthorized users to modify Access Control Lists (ACLs) and extended attributes (xattrs), as well as export files from the target system. - Attackers can create, modify, or delete ACL entries, or create directories on the target system. - A repeatable vulnerability allows attackers to modify files on a share, bypassing restrictions imposed by the share owner or authorized users. - Additionally, Yulong Xiao reported that certain operations in the module are not controlled by the user on the target system. - These vulnerabilities can be exploited by sending requests with specific identifiers to the target system, thereby bypassing the target system's access controls. Affected Scope Affected Versions: - and - and - and - and Remediation Patch Links: - https://www.openwall.com/lists/oss-security/2020/10/28/1 - https://www.openwall.com/lists/oss-security/2020/10/28/2 - https://www.openwall.com/lists/oss-security/2020/10/28/3 - https://www.openwall.com/lists/oss-security/2020/10/28/4 - https://www.openwall.com/lists/oss-security/2020/10/28/5 - https://www.openwall.com/lists/oss-security/2020/10/28/6 POC or Exploit Code No specific POC or exploit code is included in the page. Additional Information Reporter: Chen Yulong (Institute of Computing Technology, Chinese Academy of Sciences) Acknowledgments: Yulong Xiao Related Resources: - https://bugs.launchpad.net/nfs-utils/+bug/1884512 - https://bugs.launchpad.net/nfs-utils/+bug/1884513 - https://bugzilla.redhat.com/show_bug.cgi?id=1884514 Download Links Download Link: https://www.openwall.com/lists/oss-security/2020/10/28/1 Download Type: Patch files for the module Notes Do not use unencrypted emails on the mailing list and adhere to Openwall's cybersecurity guidelines. Please read and comply with Openwall's mailing list guidelines before posting messages.

Goal Reached Thanks to every supporter — we hit 100%!

Openwall NFS-utils export-import Module Unauth ACL Modification Vulnerability (CVE-2020-7159)

More from this source