Security update for autofs SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:1020-1 Final 1 1 2015-03-02T14:50:54Z current 2015-03-02T14:50:54Z 2015-03-02T14:50:54Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for autofs autofs was updated to fix one security issue. This security issue was fixed: - CVE-2014-8169: Prevent potential privilege escalation via interpreter load path for program-based automount maps (bnc#917977). These non-security issues were fixed: - Dont pass sloppy option for other than nfs mounts (bnc#901448, bnc#916203) - Fix insserv warning at postinstall (bnc#913376) - Fix autofs.service so that multiple options passed through sysconfig AUTOFS_OPTIONS work correctly (bnc#909472) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-2015-248,SUSE-SLE-SERVER-12-2015-248 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20151020-1/ Link for SUSE-SU-2015:1020-1 https://lists.suse.com/pipermail/sle-security-updates/2015-June/001428.html E-Mail link for SUSE-SU-2015:1020-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/901448 SUSE Bug 901448 https://bugzilla.suse.com/909472 SUSE Bug 909472 https://bugzilla.suse.com/913376 SUSE Bug 913376 https://bugzilla.suse.com/916203 SUSE Bug 916203 https://bugzilla.suse.com/917977 SUSE Bug 917977 https://www.suse.com/security/cve/CVE-2014-8169/ SUSE CVE CVE-2014-8169 page SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server for SAP Applications 12 autofs-5.0.9-8.1 autofs-5.0.9-8.1 as a component of SUSE Linux Enterprise Desktop 12 autofs-5.0.9-8.1 as a component of SUSE Linux Enterprise Server 12 autofs-5.0.9-8.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 automount 5.0.8, when a program map uses certain interpreted languages, uses the calling user's USER and HOME environment variable values instead of the values for the user used to run the mapped program, which allows local users to gain privileges via a Trojan horse program in the user home directory. CVE-2014-8169 SUSE Linux Enterprise Desktop 12:autofs-5.0.9-8.1 SUSE Linux Enterprise Server 12:autofs-5.0.9-8.1 SUSE Linux Enterprise Server for SAP Applications 12:autofs-5.0.9-8.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151020-1/ https://www.suse.com/security/cve/CVE-2014-8169.html CVE-2014-8169 https://bugzilla.suse.com/917977 SUSE Bug 917977