CVE-1999-0166 bug in NFS

2006-06-21 Thread Martin Marusak
I have installes OpenBSD 3.8. I exported a directory with /mnt/gamma -maproot=root 192.168.1.14 line in /etc/exports Next I tested the server with Nessus vulnerability scaner and it found a hole in NFS: --- The remote NFS server allows users to use a 'cd ..' command to access other directories

Re: CVE-1999-0166 bug in NFS

2006-06-21 Thread Otto Moerbeek
On Wed, 21 Jun 2006, Martin Marusak wrote: I have installes OpenBSD 3.8. I exported a directory with /mnt/gamma -maproot=root 192.168.1.14 line in /etc/exports Next I tested the server with Nessus vulnerability scaner and it found a hole in NFS: --- The remote NFS server allows users

Re: CVE-1999-0166 bug in NFS

2006-06-21 Thread Miod Vallat
I have installes OpenBSD 3.8. I exported a directory with /mnt/gamma -maproot=root 192.168.1.14 line in /etc/exports Next I tested the server with Nessus vulnerability scaner and it found a hole in NFS: [...] This seems like an old (1999) hole. Is there any patch for it or did I do anything

Re: CVE-1999-0166 bug in NFS

2006-06-21 Thread Nick Guenther
On 6/21/06, Miod Vallat [EMAIL PROTECTED] wrote: I have installes OpenBSD 3.8. I exported a directory with /mnt/gamma -maproot=root 192.168.1.14 line in /etc/exports Next I tested the server with Nessus vulnerability scaner and it found a hole in NFS: [...] This seems like an old (1999)

Re: CVE-1999-0166 bug in NFS

2006-06-21 Thread Ted Unangst
On 6/21/06, Nick Guenther [EMAIL PROTECTED] wrote: Why is it like this though? Seems like if you tell it to export /mnt/gamma you want it to export /mnt/gamma, not /mnt. because the only thing that identifies a file is a number. every file has a number. guess the number, and now you can open

Re: CVE-1999-0166 bug in NFS

2006-06-21 Thread Nick Guenther
On 6/21/06, Ted Unangst [EMAIL PROTECTED] wrote: On 6/21/06, Nick Guenther [EMAIL PROTECTED] wrote: Why is it like this though? Seems like if you tell it to export /mnt/gamma you want it to export /mnt/gamma, not /mnt. because the only thing that identifies a file is a number. every file has