quota's good_client() (quota-tools/rquota_svc.c) seems to be based on good_client() used by nfs-utils and portmap and is affected by similar problems as described here: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-4552#c8 With certain hosts.{allow,deny} rules, expected host access control restrictions may not be applied correctly. The problem does not affect configurations that has deny:ALL and only allow access for specific hosts / networks. The issue was reported and fixed upstream: http://sourceforge.net/tracker/?func=detail&aid=2743481&group_id=18136&atid=118136 http://linuxquota.cvs.sourceforge.net/viewvc/linuxquota/quota-tools/rquota_svc.c#rev1.21
Added CVE as per http://www.openwall.com/lists/oss-security/2012/07/19/5
Created attachment 601505 [details] Upstream fix ported to quota 3.13
Acknowledgements: This issue was discovered by the Red Hat Security Response Team.
This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2013:0120 https://rhn.redhat.com/errata/RHSA-2013-0120.html