FUSE fusermount denial of service
| fuse-fusermount-dos (55945) |  Medium Risk |
Description:
FUSE is vulnerable to a denial of service, caused by a race condition in the fusermount utility. The fusermount utility creates temporary files insecurely during umount operations. A local attacker could exploit this vulnerability by creating a symbolic link from a temporary file to various files on the system, which could allow the attacker to cause a denial of service or unmount a FUSE file system being utilized by a privileged user.
Consequences:
File Manipulation
Remedy:
Apply the appropriate patch for your system. See References.
References:
- FUSE Web site: Filesystem in Userspace.
- Red Hat Bugzilla ¿ Bug 532940: CVE-2009-3297 samba, fuse, ncpfs: Race condition by mount (mount.cifs, ncpmount) / umount (fusermount, ncpumount) operations.
- BID-37983: FUSE 'fusermount' Race Condition Vulnerability
- CVE-2010-0789: fusermount in FUSE before 2.7.5, and 2.8.x before 2.8.2, allows local users to unmount an arbitrary FUSE filesystem share via a symlink attack on a mountpoint.
- DSA-1989: fuse -- denial of service
- DSA-2004: samba -- several vulnerabilities
- MDVSA-2010:046: ncpfs
- MDVSA-2010:047: fuse
- OSVDB ID: 62376: FUSE fusermount Unmount Operation Race Condition DoS
- SA38261: FUSE "fusermount" Race Condition Denial of Service
- SUSE-SR:2010:011: SUSE Security Summary Report
- SUSE-SR:2010:013: SUSE Security Summary Report
- USN-892-1: FUSE vulnerability
- USN-893-1: Samba vulnerability
- VUPEN/ADV-2010-1107: SuSE Security Update Fixes Code Execution and Security Bypass
Platforms Affected:
- Canonical Ubuntu 6.06 LTS
- Canonical Ubuntu 8.04 LTS
- Canonical Ubuntu 8.10
- Debian Debian Linux 4.0
- Debian Debian Linux 5.0
- FedoraProject Fedora Core 11
- FedoraProject Fedora Core 12
- FUSE FUSE
- MandrakeSoft Mandrake Linux 2008.0 X86_64
- MandrakeSoft Mandrake Linux 2008.0
- MandrakeSoft Mandrake Linux Corporate Server 4.0 X86_64
- MandrakeSoft Mandrake Linux Corporate Server 4.0
- MandrakeSoft Mandrake Multi Network Firewall 2.0
- Mandriva Enterprise Server 5 X86_64
- Mandriva Enterprise Server 5
- Mandriva Linux 2009.0
- Mandriva Linux 2009.0 X86_64
- Mandriva Linux 2009.1
- Mandriva Linux 2009.1 X86_64
- Mandriva Linux 2010 X86_64
- Mandriva Linux 2010
- RedHat Enterprise Linux 4
- RedHat Enterprise Linux 5
Reported:
Jan 27, 2010
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email ignore thisxforceignore this@ignore thisus.ignore thisibm.comignore this