CVE-2007-5964

Vulnerability

The default configuration of autofs 5 shipped in some Linux distributions, notably Red Hat Enterprise Linux (RHEL) 5, omits the nosuid mount option for the /net (hosts) map. This means that when a user accesses an NFS export via the autofs automounter, the filesystem is mounted with the suid attribute enabled by default. Affected versions include autofs 5 as delivered in RHEL 5 [1][2].

Exploitation

An attacker who controls a remote NFS server can place a setuid-root binary on an exported filesystem. A local user on the affected system who then accesses that export (e.g., by changing into /net/<attacker_host>/) will cause the automounter to mount the share. The absence of nosuid allows the setuid bit to be honored. The user can then execute the malicious binary, escalating privileges. No special authentication or prior access is required beyond standard network connectivity and the ability to mount an NFS share [1][2].

Impact

Successful exploitation gives the attacker the ability to execute arbitrary code with the privileges of the setuid binary (often root). This results in a full compromise of the local system, including complete control over files, processes, and configurations. The impact is limited to systems running the vulnerable default autofs configuration [1][2].

Mitigation

Red Hat released updated packages (RHSA-2007-1128 for RHEL 5 Server, RHSA-2007-1129 for RHEL 5 Client) that modify the default configuration to include the nosuid option for the hosts map. System administrators should apply these updates or manually add nosuid to the /etc/auto.master entry for /net. No other practical workarounds exist; systems that remain unpatched continue to be exposed [1][2].