PT-2010-2520 · Filesystem In Userspace · Fuse

Dan Rosenberg · Publicado 2010-03-02 · Atualizado 2017-08-17 · CVE-2010-0789

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Baixa

Vetor base

AV:L/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions FUSE versions prior to 2.7.5 FUSE versions 2.8.x prior to 2.8.2

Description The issue allows local users to unmount an arbitrary FUSE filesystem share via a symlink attack on a mountpoint. This is related to the fusermount component in FUSE.

Recommendations For FUSE versions prior to 2.7.5, update to version 2.7.5 or later. For FUSE versions 2.8.x prior to 2.8.2, update to version 2.8.2 or later.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2010-0789

DSA-1989-1

Produtos afetados

Fuse

Referências · 23

• http://ubuntu.com/usn/USN-892-1 · Aviso do Fabricante
• http://sourceforge.net/projects/fuse/files/fuse-2.X/2.7.5/fuse-2.7.5.tar.gz/download · Correção
• https://bugzilla.redhat.com/show_bug.cgi?id=558833 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html · Aviso do Fabricante
• http://secunia.com/advisories/38437 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2010-February/034580.html · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2010-0789 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/55945 · Nota
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=567633 · Nota
• http://secunia.com/advisories/38359 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-0789 · Nota de Segurança
• http://securityfocus.com/bid/37983 · Correção
• http://lists.fedoraproject.org/pipermail/package-announce/2010-February/034518.html · Aviso do Fabricante
• http://debian.org/security/2010/dsa-1989 · Correção, Aviso do Fabricante
• http://secunia.com/advisories/38287 · Aviso do Fabricante