GLSA 201206-29: mount-cifs: Multiple vulnerabilites
Severity: | normal |
Title: | mount-cifs: Multiple vulnerabilites |
Date: | 06/25/2012 |
Bugs: |
|
ID: | 201206-29 |
Synopsis
Multiple vulnerabilities were found in mount-cifs, the worst of which leading to privilege escalation.Background
mount-cifs is the cifs filesystem mount helper split from Samba.
Affected packages
Package | Vulnerable | Unaffected | Architecture(s) |
---|---|---|---|
net-fs/mount-cifs | <= 3.0.30 | All supported architectures |
Description
Multiple vulnerabilities have been discovered in mount-cifs. Please review the CVE identifiers referenced below for details.
Impact
The vulnerabilities allow local users to cause a denial of service (mtab corruption) via a crafted string. Also, local users could mount a CIFS share on an arbitrary mountpoint, and gain privileges via a symlink attack on the mountpoint directory file.
Workaround
There is no known workaround at this time.
Resolution
Gentoo has discontinued support for mount-cifs. We recommend that users unmerge mount-cifs:
# emerge --unmerge "net-fs/mount-cifs"
References
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2010 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.