PT-2011-1122 · Red Hat · Fuse+2

Josh Bressers · Published 2011-07-20 · Updated 2023-02-13 · CVE-2011-0543

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions fuse versions 2.8.3 through 2.8.5 fuse-devel version 2.8.3 fuse-libs version 2.8.3 fuse-debuginfo version 2.8.3

Description The issue concerns multiple vulnerabilities in the fuse package of Red Hat Enterprise Linux, which can be exploited remotely to compromise the integrity and availability of protected information. Local users can bypass intended access restrictions and unmount arbitrary directories via a symlink attack when util-linux does not support the --no-canonicalize option.

Recommendations For fuse versions 2.8.3 through 2.8.5, consider updating to a version later than 2.8.5 to resolve the issue. For fuse-devel version 2.8.3, update to a newer version to mitigate the risk. For fuse-libs version 2.8.3, update to a newer version to mitigate the risk. For fuse-debuginfo version 2.8.3, update to a newer version to mitigate the risk. As a temporary workaround, consider restricting access to the fusermount functionality in fuse until a patch is available.

Fix

Link Following

Weakness Enumeration

CWE-59

CWE-264

Related Identifiers

BDU:2015-06658

BDU:2015-06659

BDU:2015-06660

BDU:2015-06661

CVE-2011-0543

RHSA-2011:1083

RHSA-2011_1083

Affected Products

Red Hat

Fuse

Util-Linux

References · 29

• http://openwall.com/lists/oss-security/2011/02/08/4 · Patch
• https://security-tracker.debian.org/tracker/CVE-2011-0543 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0543 · Security Note
• http://openwall.com/lists/oss-security/2011/02/02/2 · Patch
• https://bdu.fstec.ru/vul/2015-06661 · Security Note
• https://bdu.fstec.ru/vul/2015-06658 · Security Note
• http://openwall.com/lists/oss-security/2011/02/03/5 · Patch
• https://linux.oracle.com/errata/ELSA-2011-1083.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06659 · Security Note
• https://bdu.fstec.ru/vul/2015-06660 · Security Note
• https://osv.dev/vulnerability/CVE-2011-0543 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-0543 · Vendor Advisory
• http://openwall.com/lists/oss-security/2010/11/04/8 · Note
• https://access.redhat.com/security/cve/CVE-2011-0543 · Note