5.8 - MDVSA-2013:155

Executive Summary

Informations
Name	MDVSA-2013:155	First vendor Publication	2013-04-29
Vendor	Mandriva	Last vendor Modification	2013-04-29
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:P)
Cvss Base Score	5.8	Attack Range	Network
Cvss Impact Score	4.9	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A vulnerability has been found and corrected in fuse:

FUSE, possibly 2.8.5 and earlier, allows local users to create mtab entries with arbitrary pathnames, and consequently unmount any filesystem, via a symlink attack on the parent directory of the mountpoint of a FUSE filesystem, a different vulnerability than CVE-2010-0789 (CVE-2010-3879).

The updated packages have been patched to correct this issue.

Original Source

Url : http://www.mandriva.com/security/advisories?name=MDVSA-2013:155

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-59	Improper Link Resolution Before File Access ('Link Following')

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:13087

Oval ID:	oval:org.mitre.oval:def:13087
Title:	USN-892-1 -- fuse vulnerability
Description:	Ronald Volgers discovered that FUSE did not correctly check mount locations. A local attacker, with access to use FUSE, could unmount arbitrary locations, leading to a denial of service.
Family:	unix	Class:	patch
Reference(s):	USN-892-1 CVE-2009-3297 CVE-2010-0789	Version:	5
Platform(s):	Ubuntu 8.04 Ubuntu 8.10 Ubuntu 9.10 Ubuntu 6.06 Ubuntu 9.04	Product(s):	fuse
Definition Synopsis:
Release section Ubuntu 8.04 is installed AND Architecture section Architecture independet section Installed architecture is all AND fuse-source DPKG is earlier than 2.7.2-1ubuntu2.1 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section libfuse2 DPKG is earlier than 2.7.2-1ubuntu2.1 AND fuse-utils-udeb DPKG is earlier than 2.7.2-1ubuntu2.1 AND fuse-utils DPKG is earlier than 2.7.2-1ubuntu2.1 AND libfuse2-udeb DPKG is earlier than 2.7.2-1ubuntu2.1 AND libfuse-dev DPKG is earlier than 2.7.2-1ubuntu2.1 OR Release section Ubuntu 8.10 is installed AND Architecture section Architecture independet section Installed architecture is all AND fuse-source DPKG is earlier than 2.7.3-4ubuntu2.1 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section libfuse2 DPKG is earlier than 2.7.3-4ubuntu2.1 AND fuse-utils-udeb DPKG is earlier than 2.7.3-4ubuntu2.1 AND fuse-utils DPKG is earlier than 2.7.3-4ubuntu2.1 AND libfuse2-udeb DPKG is earlier than 2.7.3-4ubuntu2.1 AND libfuse-dev DPKG is earlier than 2.7.3-4ubuntu2.1 OR Release section Ubuntu 9.10 is installed AND Supported architectures section Installed architecture is sparc AND Installed architecture is i386 AND Installed architecture is amd64 AND Installed architecture is lpia AND Installed architecture is powerpc AND Packages section libfuse2 DPKG is earlier than 2.7.4-1.1ubuntu4.3 AND fuse-utils-udeb DPKG is earlier than 2.7.4-1.1ubuntu4.3 AND fuse-utils DPKG is earlier than 2.7.4-1.1ubuntu4.3 AND libfuse2-udeb DPKG is earlier than 2.7.4-1.1ubuntu4.3 AND libfuse-dev DPKG is earlier than 2.7.4-1.1ubuntu4.3 OR Release section Ubuntu 6.06 is installed AND Architecture section Architecture independet section Installed architecture is all AND fuse-source DPKG is earlier than 2.4.2-0ubuntu3.1 OR Architecture depended section Supported architectures section Installed architecture is sparc AND Installed architecture is powerpc AND Installed architecture is amd64 AND Installed architecture is i386 AND Packages section libfuse2 DPKG is earlier than 2.4.2-0ubuntu3.1 AND fuse-utils DPKG is earlier than 2.4.2-0ubuntu3.1 AND libfuse-dev DPKG is earlier than 2.4.2-0ubuntu3.1 OR Release section Ubuntu 9.04 is installed AND Supported architectures section Installed architecture is sparc AND Installed architecture is i386 AND Installed architecture is amd64 AND Installed architecture is lpia AND Installed architecture is powerpc AND Packages section libfuse2 DPKG is earlier than 2.7.4-1.1ubuntu4.0.9.04.1 AND fuse-utils-udeb DPKG is earlier than 2.7.4-1.1ubuntu4.0.9.04.1 AND fuse-utils DPKG is earlier than 2.7.4-1.1ubuntu4.0.9.04.1 AND libfuse2-udeb DPKG is earlier than 2.7.4-1.1ubuntu4.0.9.04.1 AND libfuse-dev DPKG is earlier than 2.7.4-1.1ubuntu4.0.9.04.1

Definition Id: oval:org.mitre.oval:def:13095

Oval ID:	oval:org.mitre.oval:def:13095
Title:	USN-1045-1 -- fuse vulnerability
Description:	It was discovered that FUSE could be tricked into incorrectly updating the mtab file when mounting filesystems. A local attacker, with access to use FUSE, could unmount arbitrary locations, leading to a denial of service.
Family:	unix	Class:	patch
Reference(s):	USN-1045-1 CVE-2010-3879	Version:	5
Platform(s):	Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04	Product(s):	fuse
Definition Synopsis:
Release section Ubuntu 8.04 is installed AND Architecture section Architecture independet section Installed architecture is all AND fuse-source DPKG is earlier than 2.7.2-1ubuntu2.2 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section libfuse2 DPKG is earlier than 2.7.2-1ubuntu2.2 AND fuse-utils-udeb DPKG is earlier than 2.7.2-1ubuntu2.2 AND fuse-utils DPKG is earlier than 2.7.2-1ubuntu2.2 AND libfuse2-udeb DPKG is earlier than 2.7.2-1ubuntu2.2 AND libfuse-dev DPKG is earlier than 2.7.2-1ubuntu2.2 OR Release section Ubuntu 10.10 is installed AND Supported architectures section Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is amd64 AND Installed architecture is powerpc AND Packages section libfuse2 DPKG is earlier than 2.8.4-1ubuntu1.1 AND fuse-utils-udeb DPKG is earlier than 2.8.4-1ubuntu1.1 AND fuse-utils DPKG is earlier than 2.8.4-1ubuntu1.1 AND libfuse2-udeb DPKG is earlier than 2.8.4-1ubuntu1.1 AND libfuse-dev DPKG is earlier than 2.8.4-1ubuntu1.1 OR Release section Ubuntu 9.10 is installed AND Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is armel AND Installed architecture is lpia AND Packages section libfuse2 DPKG is earlier than 2.7.4-1.1ubuntu4.4 AND fuse-utils-udeb DPKG is earlier than 2.7.4-1.1ubuntu4.4 AND fuse-utils DPKG is earlier than 2.7.4-1.1ubuntu4.4 AND libfuse2-udeb DPKG is earlier than 2.7.4-1.1ubuntu4.4 AND libfuse-dev DPKG is earlier than 2.7.4-1.1ubuntu4.4 OR Release section Ubuntu 10.04 is installed AND Supported architectures section Installed architecture is sparc AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is amd64 AND Installed architecture is powerpc AND Packages section libfuse2 DPKG is earlier than 2.8.1-1.1ubuntu2.2 AND fuse-utils-udeb DPKG is earlier than 2.8.1-1.1ubuntu2.2 AND fuse-utils DPKG is earlier than 2.8.1-1.1ubuntu2.2 AND libfuse2-udeb DPKG is earlier than 2.8.1-1.1ubuntu2.2 AND libfuse-dev DPKG is earlier than 2.8.1-1.1ubuntu2.2

Definition Id: oval:org.mitre.oval:def:13481

Oval ID:	oval:org.mitre.oval:def:13481
Title:	USN-1045-2 -- util-linux update
Description:	USN-1045-1 fixed vulnerabilities in FUSE. This update to util-linux adds support for new options required by the FUSE update. Original advisory details: It was discovered that FUSE could be tricked into incorrectly updating the mtab file when mounting filesystems. A local attacker, with access to use FUSE, could unmount arbitrary locations, leading to a denial of service.
Family:	unix	Class:	patch
Reference(s):	USN-1045-2 CVE-2010-3879	Version:	5
Platform(s):	Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04	Product(s):	util-linux
Definition Synopsis:
Release section Ubuntu 8.04 is installed AND Architecture section Architecture independet section Installed architecture is all AND util-linux-locales DPKG is earlier than 2.13.1-5ubuntu3.1 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section mount DPKG is earlier than 2.13.1-5ubuntu3.1 AND util-linux DPKG is earlier than 2.13.1-5ubuntu3.1 AND fdisk-udeb DPKG is earlier than 2.13.1-5ubuntu3.1 AND bsdutils DPKG is earlier than 2.13.1-5ubuntu3.1 OR Architecture depended section Supported architectures section Installed architecture is i386 AND Installed architecture is amd64 AND Installed architecture is lpia AND Installed architecture is powerpc AND cfdisk-udeb DPKG is earlier than 2.13.1-5ubuntu3.1 OR Release section Ubuntu 10.10 is installed AND Architecture section Architecture independet section Installed architecture is all AND util-linux-locales DPKG is earlier than 2.17.2-0ubuntu1.10.10.1 OR Architecture depended section Supported architectures section Installed architecture is powerpc AND Installed architecture is armel AND Installed architecture is amd64 AND Installed architecture is i386 AND Packages section util-linux DPKG is earlier than 2.17.2-0ubuntu1.10.10.1 AND fdisk-udeb DPKG is earlier than 2.17.2-0ubuntu1.10.10.1 AND libuuid1-udeb DPKG is earlier than 2.17.2-0ubuntu1.10.10.1 AND mount DPKG is earlier than 2.17.2-0ubuntu1.10.10.1 AND libblkid-dev DPKG is earlier than 2.17.2-0ubuntu1.10.10.1 AND cfdisk-udeb DPKG is earlier than 2.17.2-0ubuntu1.10.10.1 AND uuid-dev DPKG is earlier than 2.17.2-0ubuntu1.10.10.1 AND bsdutils DPKG is earlier than 2.17.2-0ubuntu1.10.10.1 AND util-linux-udeb DPKG is earlier than 2.17.2-0ubuntu1.10.10.1 AND uuid-runtime DPKG is earlier than 2.17.2-0ubuntu1.10.10.1 AND libblkid1 DPKG is earlier than 2.17.2-0ubuntu1.10.10.1 AND libblkid1-udeb DPKG is earlier than 2.17.2-0ubuntu1.10.10.1 AND libuuid1 DPKG is earlier than 2.17.2-0ubuntu1.10.10.1 OR Release section Ubuntu 9.10 is installed AND Architecture section Architecture independet section Installed architecture is all AND util-linux-locales DPKG is earlier than 2.16-1ubuntu5.1 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is powerpc AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is lpia AND Packages section util-linux DPKG is earlier than 2.16-1ubuntu5.1 AND fdisk-udeb DPKG is earlier than 2.16-1ubuntu5.1 AND libuuid1-udeb DPKG is earlier than 2.16-1ubuntu5.1 AND mount DPKG is earlier than 2.16-1ubuntu5.1 AND libblkid-dev DPKG is earlier than 2.16-1ubuntu5.1 AND uuid-dev DPKG is earlier than 2.16-1ubuntu5.1 AND bsdutils DPKG is earlier than 2.16-1ubuntu5.1 AND util-linux-udeb DPKG is earlier than 2.16-1ubuntu5.1 AND uuid-runtime DPKG is earlier than 2.16-1ubuntu5.1 AND libblkid1 DPKG is earlier than 2.16-1ubuntu5.1 AND libblkid1-udeb DPKG is earlier than 2.16-1ubuntu5.1 AND libuuid1 DPKG is earlier than 2.16-1ubuntu5.1 OR Architecture depended section Supported architectures section Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is amd64 AND Installed architecture is lpia AND Installed architecture is powerpc AND cfdisk-udeb DPKG is earlier than 2.16-1ubuntu5.1 OR Release section Ubuntu 10.04 is installed AND Architecture section Architecture independet section Installed architecture is all AND util-linux-locales DPKG is earlier than 2.17.2-0ubuntu1.10.04.1 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is armel AND Packages section libblkid1 DPKG is earlier than 2.17.2-0ubuntu1.10.04.1 AND fdisk-udeb DPKG is earlier than 2.17.2-0ubuntu1.10.04.1 AND libuuid1-udeb DPKG is earlier than 2.17.2-0ubuntu1.10.04.1 AND mount DPKG is earlier than 2.17.2-0ubuntu1.10.04.1 AND util-linux-udeb DPKG is earlier than 2.17.2-0ubuntu1.10.04.1 AND uuid-dev DPKG is earlier than 2.17.2-0ubuntu1.10.04.1 AND bsdutils DPKG is earlier than 2.17.2-0ubuntu1.10.04.1 AND libblkid-dev DPKG is earlier than 2.17.2-0ubuntu1.10.04.1 AND uuid-runtime DPKG is earlier than 2.17.2-0ubuntu1.10.04.1 AND util-linux DPKG is earlier than 2.17.2-0ubuntu1.10.04.1 AND libblkid1-udeb DPKG is earlier than 2.17.2-0ubuntu1.10.04.1 AND libuuid1 DPKG is earlier than 2.17.2-0ubuntu1.10.04.1 OR Architecture depended section Supported architectures section Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is amd64 AND Installed architecture is powerpc AND cfdisk-udeb DPKG is earlier than 2.17.2-0ubuntu1.10.04.1

CPE : Common Platform Enumeration

Type	Description	Count
Application	Fuse cpe:2.3:a:fuse:fuse:2.7.4:::::::* cpe:2.3:a:fuse:fuse:2.7.3:::::::* cpe:2.3:a:fuse:fuse:2.7.2:::::::* cpe:2.3:a:fuse:fuse:2.7.1:::::::* cpe:2.3:a:fuse:fuse:2.7.0:::::::* cpe:2.3:a:fuse:fuse:2.6.5:::::::* cpe:2.3:a:fuse:fuse:2.6.3:::::::* cpe:2.3:a:fuse:fuse:2.6.1:::::::* cpe:2.3:a:fuse:fuse:2.6.0:::::::* cpe:2.3:a:fuse:fuse:2.5.3:::::::* cpe:2.3:a:fuse:fuse:2.5.2:::::::* cpe:2.3:a:fuse:fuse:2.5.1:::::::* cpe:2.3:a:fuse:fuse:2.5.0:::::::* cpe:2.3:a:fuse:fuse:2.4.2:::::::* cpe:2.3:a:fuse:fuse:2.4.1:::::::* cpe:2.3:a:fuse:fuse:2.4.0:::::::* cpe:2.3:a:fuse:fuse:2.3.0:::::::* cpe:2.3:a:fuse:fuse:2.3:pre:::::: cpe:2.3:a:fuse:fuse:2.3:rc1:::::: cpe:2.3:a:fuse:fuse:2.2.1:::::::* cpe:2.3:a:fuse:fuse:2.2:::::::* cpe:2.3:a:fuse:fuse:2.1:::::::* cpe:2.3:a:fuse:fuse:2.0:pre0:::::: cpe:2.3:a:fuse:fuse:2.0:pre1:::::: cpe:2.3:a:fuse:fuse:1.9:::::::*	25

OpenVAS Exploits

Date	Description
2012-06-06	Name : RedHat Update for fuse RHSA-2011:1083-01 File : nvt/gb_RHSA-2011_1083-01_fuse.nasl
2011-02-11	Name : Fedora Update for util-linux-ng FEDORA-2011-0854 File : nvt/gb_fedora_2011_0854_util-linux-ng_fc14.nasl
2011-01-21	Name : Ubuntu Update for fuse vulnerability USN-1045-1 File : nvt/gb_ubuntu_USN_1045_1.nasl
2011-01-21	Name : Ubuntu Update for util-linux update USN-1045-2 File : nvt/gb_ubuntu_USN_1045_2.nasl
2010-03-02	Name : Fedora Update for fuse FEDORA-2010-1140 File : nvt/gb_fedora_2010_1140_fuse_fc11.nasl
2010-01-29	Name : Mandriva Update for evolution MDVA-2010:047 (evolution) File : nvt/gb_mandriva_MDVA_2010_047.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
70520	Fuse fusermount Arbitrary Unmount Local DoS FUSE contains a flaw that may allow a local denial of service. The issue is triggered when an error within the 'fusermount' utility when performing unmount operations occurs, allowing a local attacker to cause a denial of service by unmounting arbitrary mounts via symlink attacks.
62376	FUSE fusermount Unmount Operation Race Condition DoS

Nessus® Vulnerability Scanner

Date	Description
2014-06-13	Name : The remote openSUSE host is missing a security update. File : suse_11_3_fuse-110228.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2011-1083.nasl - Type : ACT_GATHER_INFO
2013-04-30	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2013-154.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20110720_fuse_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2011-12-13	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_util-linux-and-fuse-201103-7418.nasl - Type : ACT_GATHER_INFO
2011-07-21	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2011-1083.nasl - Type : ACT_GATHER_INFO
2011-05-05	Name : The remote openSUSE host is missing a security update. File : suse_11_2_fuse-110228.nasl - Type : ACT_GATHER_INFO
2011-04-01	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_util-linux-and-fuse-201103-7362.nasl - Type : ACT_GATHER_INFO
2011-03-31	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_util-linux-and-fuse-201103-110302.nasl - Type : ACT_GATHER_INFO
2011-03-01	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1077-1.nasl - Type : ACT_GATHER_INFO
2011-02-08	Name : The remote Fedora host is missing a security update. File : fedora_2011-0854.nasl - Type : ACT_GATHER_INFO
2011-01-27	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_fuse-6888.nasl - Type : ACT_GATHER_INFO
2011-01-27	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_fuse-6886.nasl - Type : ACT_GATHER_INFO
2011-01-27	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_fuse-6840.nasl - Type : ACT_GATHER_INFO
2011-01-27	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_fuse-6838.nasl - Type : ACT_GATHER_INFO
2011-01-20	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1045-2.nasl - Type : ACT_GATHER_INFO
2011-01-20	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1045-1.nasl - Type : ACT_GATHER_INFO
2010-12-02	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_fuse-100226.nasl - Type : ACT_GATHER_INFO
2010-07-01	Name : The remote Fedora host is missing a security update. File : fedora_2010-1140.nasl - Type : ACT_GATHER_INFO
2010-07-01	Name : The remote Fedora host is missing a security update. File : fedora_2010-1159.nasl - Type : ACT_GATHER_INFO
2010-05-01	Name : The remote openSUSE host is missing a security update. File : suse_11_0_fuse-100428.nasl - Type : ACT_GATHER_INFO
2010-05-01	Name : The remote openSUSE host is missing a security update. File : suse_11_2_fuse-100428.nasl - Type : ACT_GATHER_INFO
2010-05-01	Name : The remote openSUSE host is missing a security update. File : suse_11_1_fuse-100428.nasl - Type : ACT_GATHER_INFO
2010-02-24	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1989.nasl - Type : ACT_GATHER_INFO
2010-02-24	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2010-047.nasl - Type : ACT_GATHER_INFO
2010-02-15	Name : The remote openSUSE host is missing a security update. File : suse_11_0_fuse-100203.nasl - Type : ACT_GATHER_INFO
2010-02-15	Name : The remote openSUSE host is missing a security update. File : suse_11_2_fuse-100203.nasl - Type : ACT_GATHER_INFO
2010-02-15	Name : The remote openSUSE host is missing a security update. File : suse_11_1_fuse-100203.nasl - Type : ACT_GATHER_INFO
2010-02-03	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_fuse-100126.nasl - Type : ACT_GATHER_INFO
2010-01-29	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-892-1.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2013-05-07 21:18:46	First insertion

Global Informations

Type	Count
CWE ID(s)	2
Oval ID(s)	3
CPE ID(s)	25
osvdb(s)	2
Openvas Exploit(s)	6
Nessus® Exploit(s)	30

	Related
5.8	CVE-2010-3879
3.3	CVE-2010-0789
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 2 more Alert(s)

5.8 - MDVSA-2013:155

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

CWE : Common Weakness Enumeration

OVAL Definitions

CPE : Common Platform Enumeration

OpenVAS Exploits

Open Source Vulnerability Database (OSVDB)

Nessus® Vulnerability Scanner

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU