PT-2007-2265 · Linux · Umount

Published 2007-02-07 · Updated 2010-09-15 · CVE-2007-0822

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: umount versions prior to the fixed version

Description: The issue allows local users to trigger a NULL dereference and application crash by invoking the program with a pathname for a USB pen drive that was mounted and then physically removed. This might allow users to obtain sensitive information, including core file contents.

Recommendations: For versions prior to the fixed version, consider applying configuration changes to prevent invocation of umount with a pathname for a removed USB pen drive as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Related Identifiers

CVE-2007-0822

Affected Products

Umount

References · 7

• 🔥 http://gotfault.wordpress.com/2007/01/18/umount-bug · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-0822 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2007:053 · Vendor Advisory
• http://osvdb.org/33652 · Note
• http://securitytracker.com/id?1017729 · Note
• http://securityfocus.com/bid/22850 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2007-02/0012.html · Note