umount in util-linux 2.8 to 2.12q, 2.13-pre1, and 2.13-pre2, and other packages such as loop-aes-utils, allows local users with unmount permissions to gain privileges via the -r (remount) option, which causes the file system to be remounted with just the read-only flag, which effectively clears the nosuid, nodev, and other flags.

Updated util-linux and mount packages that fix two security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The util-linux package contains a large variety of low-level system utilities that are necessary for a Linux system to function.

The mount package contains the mount, umount, swapon and swapoff programs.

A bug was found in the way the umount command is executed by normal users. It may be possible for a user to gain elevated privileges if the user is able to execute the 'umount -r' command on a mounted file system. The file system will be re-mounted only with the 'readonly' flag set, clearing flags such as 'nosuid' and 'noexec'. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2876 to this issue.

This update also fixes a hardlink bug in the script command for Red Hat Enterprise Linux 2.1. If a local user places a hardlinked file named 'typescript' in a directory they have write access to, the file will be overwritten if the user running script has write permissions to the destination file. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2001-1494 to this issue.

All users of util-linux and mount should upgrade to these updated packages, which contain backported patches to correct these issues.

David Watson discovered that 'umount -r' removed some restrictive mount options like the 'nosuid' flag. If /etc/fstab contains user-mountable removable devices which specify the 'nosuid' flag (which is common practice for such devices), a local attacker could exploit this to execute arbitrary programs with root privileges by calling 'umount -r' on a removable device.

This does not affect the default Ubuntu configuration. Since Ubuntu mounts removable devices automatically, there is normally no need to configure them manually in /etc/fstab.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2005:782 advisory.

    The util-linux package contains a large variety of low-level system     utilities that are necessary for a Linux system to function.

    The mount package contains the mount, umount, swapon and swapoff programs.

    A bug was found in the way the umount command is executed by normal users.
    It may be possible for a user to gain elevated privileges if the user is     able to execute the umount -r command on a mounted file system. The     file system will be re-mounted only with the readonly flag set, clearing     flags such as nosuid and noexec. The Common Vulnerabilities and     Exposures project (cve.mitre.org) has assigned the name CAN-2005-2876 to     this issue.

    This update also fixes a hardlink bug in the script command for Red Hat     Enterprise Linux 2.1. If a local user places a hardlinked file named     typescript in a directory they have write access to, the file will be     overwritten if the user running script has write permissions to the     destination file. The Common Vulnerabilities and Exposures project     (cve.mitre.org) has assigned the name CAN-2001-1494 to this issue.

    All users of util-linux and mount should upgrade to these updated packages,     which contain backported patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

David Watson disovered that the umount utility, when using the '-r' cpmmand, could remove some restrictive mount options such as 'nosuid'.
IF /etc/fstab contained user-mountable removable devices that specified nosuid, a local attacker could exploit this flaw to execute arbitrary programs with root privileges by calling 'umount -r' on a removable device.

The updated packages have been patched to ensure that '-r' can only be called by the root user.

The remote host is affected by the vulnerability described in GLSA-200509-15 (util-linux: umount command validation error)

    When a regular user mounts a filesystem, they are subject to     restrictions in the /etc/fstab configuration file. David Watson     discovered that when unmounting a filesystem with the '-r' option, the     read-only bit is set, while other bits, such as nosuid or nodev, are     not set, even if they were previously.
  Impact :

    An unprivileged user facing nosuid or nodev restrictions can     umount -r a filesystem clearing those bits, allowing applications to be     executed suid, or have device nodes interpreted. In the case where the     user can freely modify the contents of the filesystem, privilege     escalation may occur as a custom program may execute with suid     permissions.
  Workaround :

    Two workarounds exist, first, the suid bit can be removed from the     umount utility, or users can be restricted from mounting and unmounting     filesystems in /etc/fstab.

David Watson discovered a bug in mount as provided by util-linux and other packages such as loop-aes-utils that allows local users to bypass filesystem access restrictions by re-mounting it read-only.

ID	Name	Product	Family	Severity
21858	CentOS 3 / 4 : util-linux / mount (CESA-2005:782)	Nessus	CentOS Local Security Checks	high
20595	Ubuntu 4.10 / 5.04 : util-linux vulnerability (USN-184-1)	Nessus	Ubuntu Local Security Checks	high
20048	RHEL 4 : util-linux and mount (RHSA-2005:782)	Nessus	Red Hat Local Security Checks	medium
19922	Mandrake Linux Security Advisory : util-linux (MDKSA-2005:167)	Nessus	Mandriva Local Security Checks	high
19814	GLSA-200509-15 : util-linux: umount command validation error	Nessus	Gentoo Local Security Checks	high
19794	Debian DSA-825-1 : loop-aes-utils - privilege escalation	Nessus	Debian Local Security Checks	high
19792	Debian DSA-823-1 : util-linux - privilege escalation	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2005-2876

high

Tenable Plugins

high

high

medium

high

high

high

high