FOG is a free open-source cloning/imaging/rescue suite/inventory management system. There is a security issue with the NFS configuration in /etc/exports generated by the installer that allows an attacker to modify files outside the export in the default installation. The exports have the no_subtree_check option. The no_subtree_check option means that if a client performs a file operation, the server will only check if the requested file is on the correct filesystem, not if it is in the correct directory. This enables modifying files in /images, accessing other files on the same filesystem, and accessing files on other filesystems. This vulnerability is fixed in 1.5.10.30.
References
| Link | Resource |
|---|---|
| https://github.com/FOGProject/fogproject/security/advisories/GHSA-3xjr-xf9v-hwjh | Third Party Advisory |
| https://github.com/FOGProject/fogproject/commit/2de209bc57a177a052b4a877f000c591740b2f88 | Patch |
Configurations
History
05 Sep 2024, 15:34
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/FOGProject/fogproject/commit/2de209bc57a177a052b4a877f000c591740b2f88 - Patch | |
| References | () https://github.com/FOGProject/fogproject/security/advisories/GHSA-3xjr-xf9v-hwjh - Third Party Advisory | |
| CWE | CWE-1188 | |
| CPE | cpe:2.3:a:fogproject:fogproject:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.4 |
| First Time |
Fogproject
Fogproject fogproject |
12 Jul 2024, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-07-12 15:15
Updated : 2024-09-05 15:34
NVD link : CVE-2024-39916
Mitre link : CVE-2024-39916
JSON object : View
Products Affected
fogproject
- fogproject
CWE
CWE-1188
Insecure Default Initialization of Resource