PT-2011-1086 · Canonical+2 · Ecryptfs-Utils-Devel+5

Published 2011-08-31 · Updated 2019-10-09 · CVE-2011-3145

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ecryptfs-utils-devel versions 75 through 82 ecryptfs-utils versions 75 through 82 ecryptfs-utils-gui versions 75 ecryptfs-utils-debuginfo versions 82

Description The issue concerns multiple vulnerabilities in the ecryptfs-utils package, which can lead to a breach of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited locally. According to the NVD, when mount.ecryptfs private before version 87-0ubuntu1.2 calls setreuid(), it doesn't also set the effective group id, resulting in the creation of mtab.tmp with the group id of the user running mount.ecryptfs private.

Recommendations For ecryptfs-utils-devel versions 75 through 82, update to a version newer than 82. For ecryptfs-utils versions 75 through 82, update to a version newer than 82. For ecryptfs-utils-gui version 75, update to a version newer than 75. For ecryptfs-utils-debuginfo version 82, update to a version newer than 82. As a temporary workaround, consider restricting access to the vulnerable mount.ecryptfs private function until a patch is available.

Fix

Weakness Enumeration

CWE-264

CWE-254

Related Identifiers

BDU:2015-02608

BDU:2015-05975

BDU:2015-05976

BDU:2015-05977

BDU:2015-05978

BDU:2015-05979

BDU:2015-05980

BDU:2015-08749

BDU:2015-08750

BDU:2015-08751

BDU:2015-08752

BDU:2015-08753

BDU:2015-08754

CVE-2011-3145

DSA-2382-1

RHSA-2011:1241

RHSA-2011_1241

SUSE-SU-2012_0682-1

Affected Products

Red Hat

Suse

Ecryptfs-Utils

Ecryptfs-Utils-Debuginfo

Ecryptfs-Utils-Devel

Ecryptfs-Utils-Gui

References · 47

• https://bdu.fstec.ru/vul/2015-05977 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1837 · Security Note
• https://bdu.fstec.ru/vul/2015-02608 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1834 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1832 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2011-3145 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-3145 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-3145 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1835 · Security Note
• https://bdu.fstec.ru/vul/2015-08752 · Security Note
• https://bdu.fstec.ru/vul/2015-04438 · Security Note
• https://bdu.fstec.ru/vul/2015-05980 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3145 · Security Note
• https://bdu.fstec.ru/vul/2015-08750 · Security Note
• https://bdu.fstec.ru/vul/2015-04439 · Security Note