PT-2011-1121 · Red Hat · Fuse-Devel+4

Josh Bressers · Published 2011-07-20 · Updated 2023-02-13 · CVE-2011-0542

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions fuse versions 2.8.3 through 2.8.5 fuse-devel versions 2.8.3 fuse-libs versions 2.8.3 fuse-debuginfo versions 2.8.3

Description The issue concerns multiple vulnerabilities in the fuse package of Red Hat Enterprise Linux, which can lead to disruption of data integrity and availability. These vulnerabilities can be exploited remotely. Local users can also unmount arbitrary directories via unspecified vectors due to the behavior of fusermount in fuse versions 2.8.5 and earlier, which does not perform a chdir to / before performing a mount or umount.

Recommendations For fuse versions 2.8.3 through 2.8.5, consider updating to a version later than 2.8.5 to resolve the issue. For fuse-devel version 2.8.3, update to a version later than 2.8.3. For fuse-libs version 2.8.3, update to a version later than 2.8.3. For fuse-debuginfo version 2.8.3, update to a version later than 2.8.3. As a temporary workaround, consider restricting access to the fusermount functionality until a patch is available.

Fix

Link Following

Weakness Enumeration

CWE-59

CWE-264

Related Identifiers

BDU:2015-06658

BDU:2015-06659

BDU:2015-06660

BDU:2015-06661

CVE-2011-0542

RHSA-2011:1083

RHSA-2011_1083

Affected Products

Red Hat

Fuse

Fuse-Debuginfo

Fuse-Devel

Fuse-Libs

References · 28

• https://linux.oracle.com/errata/ELSA-2011-1083.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0542 · Security Note
• http://openwall.com/lists/oss-security/2011/02/08/4 · Patch
• https://bdu.fstec.ru/vul/2015-06659 · Security Note
• https://bdu.fstec.ru/vul/2015-06660 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-0542 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-0542 · Vendor Advisory
• http://openwall.com/lists/oss-security/2011/02/02/2 · Patch
• https://bdu.fstec.ru/vul/2015-06661 · Security Note
• https://osv.dev/vulnerability/CVE-2011-0542 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06658 · Security Note
• http://openwall.com/lists/oss-security/2011/02/03/5 · Patch
• http://fuse.git.sourceforge.net/git/gitweb.cgi?p=fuse/fuse%3Ba=commit%3Bh=1e7607ff89c65b005f69e27aeb1649d624099873 · Note
• http://openwall.com/lists/oss-security/2010/11/04/8 · Note
• http://halfdog.net/Security/FuseTimerace · Note