5.8 - CVE-2010-3879

Executive Summary

Informations
Name	CVE-2010-3879	First vendor Publication	2011-01-22
Vendor	Cve	Last vendor Modification	2020-11-10

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:P)
Cvss Base Score	5.8	Attack Range	Network
Cvss Impact Score	4.9	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

FUSE, possibly 2.8.5 and earlier, allows local users to create mtab entries with arbitrary pathnames, and consequently unmount any filesystem, via a symlink attack on the parent directory of the mountpoint of a FUSE filesystem, a different vulnerability than CVE-2010-0789.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3879

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-59	Improper Link Resolution Before File Access ('Link Following')

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:13095

Oval ID:	oval:org.mitre.oval:def:13095
Title:	USN-1045-1 -- fuse vulnerability
Description:	It was discovered that FUSE could be tricked into incorrectly updating the mtab file when mounting filesystems. A local attacker, with access to use FUSE, could unmount arbitrary locations, leading to a denial of service.
Family:	unix	Class:	patch
Reference(s):	USN-1045-1 CVE-2010-3879	Version:	5
Platform(s):	Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04	Product(s):	fuse
Definition Synopsis:
Release section Ubuntu 8.04 is installed AND Architecture section Architecture independet section Installed architecture is all AND fuse-source DPKG is earlier than 2.7.2-1ubuntu2.2 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section libfuse2 DPKG is earlier than 2.7.2-1ubuntu2.2 AND fuse-utils-udeb DPKG is earlier than 2.7.2-1ubuntu2.2 AND fuse-utils DPKG is earlier than 2.7.2-1ubuntu2.2 AND libfuse2-udeb DPKG is earlier than 2.7.2-1ubuntu2.2 AND libfuse-dev DPKG is earlier than 2.7.2-1ubuntu2.2 OR Release section Ubuntu 10.10 is installed AND Supported architectures section Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is amd64 AND Installed architecture is powerpc AND Packages section libfuse2 DPKG is earlier than 2.8.4-1ubuntu1.1 AND fuse-utils-udeb DPKG is earlier than 2.8.4-1ubuntu1.1 AND fuse-utils DPKG is earlier than 2.8.4-1ubuntu1.1 AND libfuse2-udeb DPKG is earlier than 2.8.4-1ubuntu1.1 AND libfuse-dev DPKG is earlier than 2.8.4-1ubuntu1.1 OR Release section Ubuntu 9.10 is installed AND Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is armel AND Installed architecture is lpia AND Packages section libfuse2 DPKG is earlier than 2.7.4-1.1ubuntu4.4 AND fuse-utils-udeb DPKG is earlier than 2.7.4-1.1ubuntu4.4 AND fuse-utils DPKG is earlier than 2.7.4-1.1ubuntu4.4 AND libfuse2-udeb DPKG is earlier than 2.7.4-1.1ubuntu4.4 AND libfuse-dev DPKG is earlier than 2.7.4-1.1ubuntu4.4 OR Release section Ubuntu 10.04 is installed AND Supported architectures section Installed architecture is sparc AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is amd64 AND Installed architecture is powerpc AND Packages section libfuse2 DPKG is earlier than 2.8.1-1.1ubuntu2.2 AND fuse-utils-udeb DPKG is earlier than 2.8.1-1.1ubuntu2.2 AND fuse-utils DPKG is earlier than 2.8.1-1.1ubuntu2.2 AND libfuse2-udeb DPKG is earlier than 2.8.1-1.1ubuntu2.2 AND libfuse-dev DPKG is earlier than 2.8.1-1.1ubuntu2.2

Definition Id: oval:org.mitre.oval:def:13481

Oval ID:	oval:org.mitre.oval:def:13481
Title:	USN-1045-2 -- util-linux update
Description:	USN-1045-1 fixed vulnerabilities in FUSE. This update to util-linux adds support for new options required by the FUSE update. Original advisory details: It was discovered that FUSE could be tricked into incorrectly updating the mtab file when mounting filesystems. A local attacker, with access to use FUSE, could unmount arbitrary locations, leading to a denial of service.
Family:	unix	Class:	patch
Reference(s):	USN-1045-2 CVE-2010-3879	Version:	5
Platform(s):	Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04	Product(s):	util-linux
Definition Synopsis:
Release section Ubuntu 8.04 is installed AND Architecture section Architecture independet section Installed architecture is all AND util-linux-locales DPKG is earlier than 2.13.1-5ubuntu3.1 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section mount DPKG is earlier than 2.13.1-5ubuntu3.1 AND util-linux DPKG is earlier than 2.13.1-5ubuntu3.1 AND fdisk-udeb DPKG is earlier than 2.13.1-5ubuntu3.1 AND bsdutils DPKG is earlier than 2.13.1-5ubuntu3.1 OR Architecture depended section Supported architectures section Installed architecture is i386 AND Installed architecture is amd64 AND Installed architecture is lpia AND Installed architecture is powerpc AND cfdisk-udeb DPKG is earlier than 2.13.1-5ubuntu3.1 OR Release section Ubuntu 10.10 is installed AND Architecture section Architecture independet section Installed architecture is all AND util-linux-locales DPKG is earlier than 2.17.2-0ubuntu1.10.10.1 OR Architecture depended section Supported architectures section Installed architecture is powerpc AND Installed architecture is armel AND Installed architecture is amd64 AND Installed architecture is i386 AND Packages section util-linux DPKG is earlier than 2.17.2-0ubuntu1.10.10.1 AND fdisk-udeb DPKG is earlier than 2.17.2-0ubuntu1.10.10.1 AND libuuid1-udeb DPKG is earlier than 2.17.2-0ubuntu1.10.10.1 AND mount DPKG is earlier than 2.17.2-0ubuntu1.10.10.1 AND libblkid-dev DPKG is earlier than 2.17.2-0ubuntu1.10.10.1 AND cfdisk-udeb DPKG is earlier than 2.17.2-0ubuntu1.10.10.1 AND uuid-dev DPKG is earlier than 2.17.2-0ubuntu1.10.10.1 AND bsdutils DPKG is earlier than 2.17.2-0ubuntu1.10.10.1 AND util-linux-udeb DPKG is earlier than 2.17.2-0ubuntu1.10.10.1 AND uuid-runtime DPKG is earlier than 2.17.2-0ubuntu1.10.10.1 AND libblkid1 DPKG is earlier than 2.17.2-0ubuntu1.10.10.1 AND libblkid1-udeb DPKG is earlier than 2.17.2-0ubuntu1.10.10.1 AND libuuid1 DPKG is earlier than 2.17.2-0ubuntu1.10.10.1 OR Release section Ubuntu 9.10 is installed AND Architecture section Architecture independet section Installed architecture is all AND util-linux-locales DPKG is earlier than 2.16-1ubuntu5.1 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is powerpc AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is lpia AND Packages section util-linux DPKG is earlier than 2.16-1ubuntu5.1 AND fdisk-udeb DPKG is earlier than 2.16-1ubuntu5.1 AND libuuid1-udeb DPKG is earlier than 2.16-1ubuntu5.1 AND mount DPKG is earlier than 2.16-1ubuntu5.1 AND libblkid-dev DPKG is earlier than 2.16-1ubuntu5.1 AND uuid-dev DPKG is earlier than 2.16-1ubuntu5.1 AND bsdutils DPKG is earlier than 2.16-1ubuntu5.1 AND util-linux-udeb DPKG is earlier than 2.16-1ubuntu5.1 AND uuid-runtime DPKG is earlier than 2.16-1ubuntu5.1 AND libblkid1 DPKG is earlier than 2.16-1ubuntu5.1 AND libblkid1-udeb DPKG is earlier than 2.16-1ubuntu5.1 AND libuuid1 DPKG is earlier than 2.16-1ubuntu5.1 OR Architecture depended section Supported architectures section Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is amd64 AND Installed architecture is lpia AND Installed architecture is powerpc AND cfdisk-udeb DPKG is earlier than 2.16-1ubuntu5.1 OR Release section Ubuntu 10.04 is installed AND Architecture section Architecture independet section Installed architecture is all AND util-linux-locales DPKG is earlier than 2.17.2-0ubuntu1.10.04.1 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is armel AND Packages section libblkid1 DPKG is earlier than 2.17.2-0ubuntu1.10.04.1 AND fdisk-udeb DPKG is earlier than 2.17.2-0ubuntu1.10.04.1 AND libuuid1-udeb DPKG is earlier than 2.17.2-0ubuntu1.10.04.1 AND mount DPKG is earlier than 2.17.2-0ubuntu1.10.04.1 AND util-linux-udeb DPKG is earlier than 2.17.2-0ubuntu1.10.04.1 AND uuid-dev DPKG is earlier than 2.17.2-0ubuntu1.10.04.1 AND bsdutils DPKG is earlier than 2.17.2-0ubuntu1.10.04.1 AND libblkid-dev DPKG is earlier than 2.17.2-0ubuntu1.10.04.1 AND uuid-runtime DPKG is earlier than 2.17.2-0ubuntu1.10.04.1 AND util-linux DPKG is earlier than 2.17.2-0ubuntu1.10.04.1 AND libblkid1-udeb DPKG is earlier than 2.17.2-0ubuntu1.10.04.1 AND libuuid1 DPKG is earlier than 2.17.2-0ubuntu1.10.04.1 OR Architecture depended section Supported architectures section Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is amd64 AND Installed architecture is powerpc AND cfdisk-udeb DPKG is earlier than 2.17.2-0ubuntu1.10.04.1

OpenVAS Exploits

Date	Description
2012-06-06	Name : RedHat Update for fuse RHSA-2011:1083-01 File : nvt/gb_RHSA-2011_1083-01_fuse.nasl
2011-02-11	Name : Fedora Update for util-linux-ng FEDORA-2011-0854 File : nvt/gb_fedora_2011_0854_util-linux-ng_fc14.nasl
2011-01-21	Name : Ubuntu Update for fuse vulnerability USN-1045-1 File : nvt/gb_ubuntu_USN_1045_1.nasl
2011-01-21	Name : Ubuntu Update for util-linux update USN-1045-2 File : nvt/gb_ubuntu_USN_1045_2.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
70520	Fuse fusermount Arbitrary Unmount Local DoS FUSE contains a flaw that may allow a local denial of service. The issue is triggered when an error within the 'fusermount' utility when performing unmount operations occurs, allowing a local attacker to cause a denial of service by unmounting arbitrary mounts via symlink attacks.

Nessus® Vulnerability Scanner

Date	Description
2014-06-13	Name : The remote openSUSE host is missing a security update. File : suse_11_3_fuse-110228.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2011-1083.nasl - Type : ACT_GATHER_INFO
2013-04-30	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2013-154.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20110720_fuse_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2011-12-13	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_util-linux-and-fuse-201103-7418.nasl - Type : ACT_GATHER_INFO
2011-07-21	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2011-1083.nasl - Type : ACT_GATHER_INFO
2011-05-05	Name : The remote openSUSE host is missing a security update. File : suse_11_2_fuse-110228.nasl - Type : ACT_GATHER_INFO
2011-04-01	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_util-linux-and-fuse-201103-7362.nasl - Type : ACT_GATHER_INFO
2011-03-31	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_util-linux-and-fuse-201103-110302.nasl - Type : ACT_GATHER_INFO
2011-02-08	Name : The remote Fedora host is missing a security update. File : fedora_2011-0854.nasl - Type : ACT_GATHER_INFO
2011-01-20	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1045-1.nasl - Type : ACT_GATHER_INFO
2011-01-20	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1045-2.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source	Url
BID	http://www.securityfocus.com/bid/44623
CONFIRM	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=602333 https://bugs.launchpad.net/bugs/670622 https://bugzilla.novell.com/show_bug.cgi?id=651598 https://bugzilla.redhat.com/show_bug.cgi?id=651183
FEDORA	http://lists.fedoraproject.org/pipermail/package-announce/2011-February/05379...
FULLDISC	http://lists.grok.org.uk/pipermail/full-disclosure/2010-November/077247.html
MANDRIVA	http://www.mandriva.com/security/advisories?name=MDVSA-2013:155
MISC	http://www.halfdog.net/Security/FuseTimerace/
MLIST	http://openwall.com/lists/oss-security/2010/11/04/8 http://openwall.com/lists/oss-security/2010/11/05/2
OSVDB	http://osvdb.org/70520
SECUNIA	http://secunia.com/advisories/42961 http://secunia.com/advisories/42965
SUSE	http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html
UBUNTU	http://www.ubuntu.com/usn/USN-1045-1 http://www.ubuntu.com/usn/USN-1045-2
VUPEN	http://www.vupen.com/english/advisories/2011/0181 http://www.vupen.com/english/advisories/2011/0302
XF	https://exchange.xforce.ibmcloud.com/vulnerabilities/62986

Alert History

If you want to see full details history, please login or register.

Date	Informations
2020-11-10 21:23:19	Multiple Updates
2020-05-23 00:26:44	Multiple Updates
2017-08-17 09:23:08	Multiple Updates
2016-06-28 18:21:01	Multiple Updates
2016-04-26 20:10:30	Multiple Updates
2014-06-14 13:29:39	Multiple Updates
2014-02-17 10:58:10	Multiple Updates
2014-02-12 13:22:00	Multiple Updates
2013-08-22 13:18:55	Multiple Updates
2013-05-10 23:35:14	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	2
Sources(s)	20
osvdb(s)	1
Openvas Exploit(s)	4
Nessus® Exploit(s)	12

	Related
5.8	USN-1045-2
5.8	USN-1045-1
5.8	RHSA-2011:1083
5.8	MDVSA-2013:155
5.8	MDVSA-2013:154
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 5 more Alert(s)

5.8 - CVE-2010-3879

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

CWE : Common Weakness Enumeration

OVAL Definitions

OpenVAS Exploits

Open Source Vulnerability Database (OSVDB)

Nessus® Vulnerability Scanner

Sources (Detail)

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU