Homepage

Incorrect Default Permissions The advisory has been revoked - it doesn't affect any version of package nfs-utils  (opens in a new tab)

Threat Intelligence

EPSS
1.52% (72nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1404-NFSUTILS-1620597
  • published19 Sept 2019
  • disclosed19 Sept 2019
Report a new vulnerability Found a mistake?

Introduced: 19 Sep 2019

CVE-2019-3689  (opens in a new tab)
CWE-276  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:14.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream nfs-utils package and not the nfs-utils package as distributed by Ubuntu.

The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. This directory contains files owned and managed by root. If statd is compromised, it can therefore trick processes running with root privileges into creating/overwriting files anywhere on the system.