client/mount.cifs.c in mount.cifs in smbfs in Samba 3.4.5 and earlier does not verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which allows local users to cause a denial of service (mtab corruption) via a crafted string.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party libraries :

  - COS kernel
  - cURL
  - python
  - rpm

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-1219 advisory.

    - Security Release, Add fix also for CVE-2011-2724
    - Security Release, fixes CVE-2010-0547, CVE-2010-0787, CVE-2011-2694,       CVE-2011-2522, CVE-2011-1678

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Samba is a suite of programs used by machines to share files, printers, and other information.

A cross-site scripting (XSS) flaw was found in the password change page of the Samba Web Administration Tool (SWAT). If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially crafted URL, it would lead to arbitrary web script execution in the context of the user's SWAT session.
(CVE-2011-2694)

It was found that SWAT web pages did not protect against Cross-Site Request Forgery (CSRF) attacks. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially crafted URL, the attacker could perform Samba configuration changes with the privileges of the logged in user. (CVE-2011-2522)

A race condition flaw was found in the way the mount.cifs tool mounted CIFS (Common Internet File System) shares. If mount.cifs had the setuid bit set, a local attacker could conduct a symbolic link attack to trick mount.cifs into mounting a share over an arbitrary directory they were otherwise not allowed to mount to, possibly allowing them to escalate their privileges. (CVE-2010-0787)

It was found that the mount.cifs tool did not properly handle share or directory names containing a newline character. If mount.cifs had the setuid bit set, a local attacker could corrupt the mtab (mounted file systems table) file via a specially crafted CIFS share mount request.
(CVE-2010-0547)

It was found that the mount.cifs tool did not handle certain errors correctly when updating the mtab file. If mount.cifs had the setuid bit set, a local attacker could corrupt the mtab file by setting a small file size limit before running mount.cifs. (CVE-2011-1678)

Note: mount.cifs from the samba packages distributed by Red Hat does not have the setuid bit set. We recommend that administrators do not manually set the setuid bit for mount.cifs.

Users of Samba are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. After installing this update, the smb service will be restarted automatically.

Samba is a suite of programs used by machines to share files, printers, and other information.

A cross-site scripting (XSS) flaw was found in the password change page of the Samba Web Administration Tool (SWAT). If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially crafted URL, it would lead to arbitrary web script execution in the context of the user's SWAT session.
(CVE-2011-2694)

It was found that SWAT web pages did not protect against Cross-Site Request Forgery (CSRF) attacks. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially crafted URL, the attacker could perform Samba configuration changes with the privileges of the logged in user. (CVE-2011-2522)

It was found that the fix for CVE-2010-0547 was incomplete. The mount.cifs tool did not properly handle share or directory names containing a newline character, allowing a local attacker to corrupt the mtab (mounted file systems table) file via a specially crafted CIFS (Common Internet File System) share mount request, if mount.cifs had the setuid bit set. (CVE-2011-2724)

It was found that the mount.cifs tool did not handle certain errors correctly when updating the mtab file. If mount.cifs had the setuid bit set, a local attacker could corrupt the mtab file by setting a small file size limit before running mount.cifs. (CVE-2011-1678)

Note: mount.cifs from the samba3x packages distributed by Scientific Linux does not have the setuid bit set. We recommend that administrators do not manually set the setuid bit for mount.cifs.

Users of Samba are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. After installing this update, the smb service will be restarted automatically.

The remote host is affected by the vulnerability described in GLSA-201206-29 (mount-cifs: Multiple vulnerabilites)

    Multiple vulnerabilities have been discovered in mount-cifs. Please       review the CVE identifiers referenced below for details.
  Impact :

    The vulnerabilities allow local users to cause a denial of service (mtab       corruption) via a crafted string. Also, local users could mount a CIFS       share on an arbitrary mountpoint, and gain privileges via a symlink       attack on the mountpoint directory file.
  Workaround :

    There is no known workaround at this time.

a. ESX third-party update for Service Console kernel      The ESX Service Console Operating System (COS) kernel is updated to    kernel-2.6.18-274.3.1.el5 to fix multiple security issues in the    COS kernel.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2011-0726, CVE-2011-1078, CVE-2011-1079,    CVE-2011-1080, CVE-2011-1093, CVE-2011-1163, CVE-2011-1166,    CVE-2011-1170, CVE-2011-1171, CVE-2011-1172, CVE-2011-1494,    CVE-2011-1495, CVE-2011-1577, CVE-2011-1763, CVE-2010-4649,    CVE-2011-0695, CVE-2011-0711, CVE-2011-1044, CVE-2011-1182,    CVE-2011-1573, CVE-2011-1576, CVE-2011-1593, CVE-2011-1745,    CVE-2011-1746, CVE-2011-1776, CVE-2011-1936, CVE-2011-2022,    CVE-2011-2213, CVE-2011-2492, CVE-2011-1780, CVE-2011-2525,    CVE-2011-2689, CVE-2011-2482, CVE-2011-2491, CVE-2011-2495,    CVE-2011-2517, CVE-2011-2519, CVE-2011-2901 to these issues.
  b. ESX third-party update for Service Console cURL RPM      The ESX Service Console (COS) curl RPM is updated to cURL-7.15.5.9    resolving a security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the name CVE-2011-2192 to this issue.
  c. ESX third-party update for Service Console nspr and nss RPMs      The ESX Service Console (COS) nspr and nss RPMs are updated to    nspr-4.8.8-1.el5_7 and nss-3.12.10-4.el5_7 respectively resolving    a security issues.
     A Certificate Authority (CA) issued fraudulent SSL certificates and    Netscape Portable Runtime (NSPR) and Network Security Services (NSS)    contain the built-in tokens of this fraudulent Certificate    Authority. This update renders all SSL certificates signed by the    fraudulent CA as untrusted for all uses.
  d. ESX third-party update for Service Console rpm RPMs      The ESX Service Console Operating System (COS) rpm packages are    updated to popt-1.10.2.3-22.el5_7.2, rpm-4.4.2.3-22.el5_7.2,    rpm-libs-4.4.2.3-22.el5_7.2 and rpm-python-4.4.2.3-22.el5_7.2    which fixes multiple security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2010-2059 and CVE-2011-3378 to these    issues.
  e. ESX third-party update for Service Console samba RPMs      The ESX Service Console Operating System (COS) samba packages are    updated to samba-client-3.0.33-3.29.el5_7.4,    samba-common-3.0.33-3.29.el5_7.4 and    libsmbclient-3.0.33-3.29.el5_7.4 which fixes multiple security    issues in the Samba client.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2010-0547, CVE-2010-0787, CVE-2011-1678,    CVE-2011-2522 and CVE-2011-2694 to these issues.
     Note that ESX does not include the Samba Web Administration Tool    (SWAT) and therefore ESX COS is not affected by CVE-2011-2522 and    CVE-2011-2694.
  f. ESX third-party update for Service Console python package      The ESX Service Console (COS) python package is updated to    2.4.3-44 which fixes multiple security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2009-3720, CVE-2010-3493, CVE-2011-1015 and    CVE-2011-1521 to these issues.
  g. ESXi update to third-party component python      The python third-party library is updated to python 2.5.6 which    fixes multiple security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2009-3560, CVE-2009-3720, CVE-2010-1634,    CVE-2010-2089, and CVE-2011-1521 to these issues.

Updated samba3x packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Samba is a suite of programs used by machines to share files, printers, and other information.

A cross-site scripting (XSS) flaw was found in the password change page of the Samba Web Administration Tool (SWAT). If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially crafted URL, it would lead to arbitrary web script execution in the context of the user's SWAT session.
(CVE-2011-2694)

It was found that SWAT web pages did not protect against Cross-Site Request Forgery (CSRF) attacks. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially crafted URL, the attacker could perform Samba configuration changes with the privileges of the logged in user. (CVE-2011-2522)

It was found that the fix for CVE-2010-0547, provided by the Samba rebase in RHBA-2011:0054, was incomplete. The mount.cifs tool did not properly handle share or directory names containing a newline character, allowing a local attacker to corrupt the mtab (mounted file systems table) file via a specially crafted CIFS (Common Internet File System) share mount request, if mount.cifs had the setuid bit set.
(CVE-2011-2724)

It was found that the mount.cifs tool did not handle certain errors correctly when updating the mtab file. If mount.cifs had the setuid bit set, a local attacker could corrupt the mtab file by setting a small file size limit before running mount.cifs. (CVE-2011-1678)

Note: mount.cifs from the samba3x packages distributed by Red Hat does not have the setuid bit set. We recommend that administrators do not manually set the setuid bit for mount.cifs.

Red Hat would like to thank the Samba project for reporting CVE-2011-2694 and CVE-2011-2522, and Dan Rosenberg for reporting CVE-2011-1678. Upstream acknowledges Nobuhiro Tsuji of NTT DATA Security Corporation as the original reporter of CVE-2011-2694, and Yoshihiro Ishikawa of LAC Co., Ltd. as the original reporter of CVE-2011-2522.

Users of Samba are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. After installing this update, the smb service will be restarted automatically.

Updated samba and cifs-utils packages that fix multiple security issues and one bug are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Samba is a suite of programs used by machines to share files, printers, and other information. The cifs-utils package contains utilities for mounting and managing CIFS (Common Internet File System) shares.

A cross-site scripting (XSS) flaw was found in the password change page of the Samba Web Administration Tool (SWAT). If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially crafted URL, it would lead to arbitrary web script execution in the context of the user's SWAT session.
(CVE-2011-2694)

It was found that SWAT web pages did not protect against Cross-Site Request Forgery (CSRF) attacks. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially crafted URL, the attacker could perform Samba configuration changes with the privileges of the logged in user. (CVE-2011-2522)

It was found that the fix for CVE-2010-0547, provided in the cifs-utils package included in the GA release of Red Hat Enterprise Linux 6, was incomplete. The mount.cifs tool did not properly handle share or directory names containing a newline character, allowing a local attacker to corrupt the mtab (mounted file systems table) file via a specially crafted CIFS share mount request, if mount.cifs had the setuid bit set. (CVE-2011-2724)

It was found that the mount.cifs tool did not handle certain errors correctly when updating the mtab file. If mount.cifs had the setuid bit set, a local attacker could corrupt the mtab file by setting a small file size limit before running mount.cifs. (CVE-2011-1678)

Note: mount.cifs from the cifs-utils package distributed by Red Hat does not have the setuid bit set. We recommend that administrators do not manually set the setuid bit for mount.cifs.

Red Hat would like to thank the Samba project for reporting CVE-2011-2694 and CVE-2011-2522, and Dan Rosenberg for reporting CVE-2011-1678. Upstream acknowledges Nobuhiro Tsuji of NTT DATA Security Corporation as the original reporter of CVE-2011-2694, and Yoshihiro Ishikawa of LAC Co., Ltd. as the original reporter of CVE-2011-2522.

This update also fixes the following bug :

* If plain text passwords were used ('encrypt passwords = no' in '/etc/samba/smb.conf'), Samba clients running the Windows XP or Windows Server 2003 operating system may not have been able to access Samba shares after installing the Microsoft Security Bulletin MS11-043. This update corrects this issue, allowing such clients to use plain text passwords to access Samba shares. (BZ#728517)

Users of samba and cifs-utils are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.
After installing this update, the smb service will be restarted automatically.

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:1219 advisory.

  - samba: mount.cifs improper device name and mountpoint strings sanitization (CVE-2010-0547)

  - samba: Race condition by mount (mount.cifs) operations (CVE-2010-0787)

  - samba/cifs-utils: mount.cifs and umount.cifs fail to anticipate RLIMIT_FSIZE (CVE-2011-1678)

  - samba (SWAT): Absent CSRF protection in various Samba web configuration formulars (CVE-2011-2522)

  - samba (SWAT): XSS flaw in Change Password page (CVE-2011-2694)

  - Samba mtab lock file race condition (CVE-2011-3585)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated samba packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Samba is a suite of programs used by machines to share files, printers, and other information.

A cross-site scripting (XSS) flaw was found in the password change page of the Samba Web Administration Tool (SWAT). If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially crafted URL, it would lead to arbitrary web script execution in the context of the user's SWAT session.
(CVE-2011-2694)

It was found that SWAT web pages did not protect against Cross-Site Request Forgery (CSRF) attacks. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially crafted URL, the attacker could perform Samba configuration changes with the privileges of the logged in user. (CVE-2011-2522)

A race condition flaw was found in the way the mount.cifs tool mounted CIFS (Common Internet File System) shares. If mount.cifs had the setuid bit set, a local attacker could conduct a symbolic link attack to trick mount.cifs into mounting a share over an arbitrary directory they were otherwise not allowed to mount to, possibly allowing them to escalate their privileges. (CVE-2010-0787)

It was found that the mount.cifs tool did not properly handle share or directory names containing a newline character. If mount.cifs had the setuid bit set, a local attacker could corrupt the mtab (mounted file systems table) file via a specially crafted CIFS share mount request.
(CVE-2010-0547)

It was found that the mount.cifs tool did not handle certain errors correctly when updating the mtab file. If mount.cifs had the setuid bit set, a local attacker could corrupt the mtab file by setting a small file size limit before running mount.cifs. (CVE-2011-1678)

Note: mount.cifs from the samba packages distributed by Red Hat does not have the setuid bit set. We recommend that administrators do not manually set the setuid bit for mount.cifs.

Red Hat would like to thank the Samba project for reporting CVE-2011-2694 and CVE-2011-2522; the Debian Security Team for reporting CVE-2010-0787; and Dan Rosenberg for reporting CVE-2011-1678. Upstream acknowledges Nobuhiro Tsuji of NTT DATA Security Corporation as the original reporter of CVE-2011-2694;
Yoshihiro Ishikawa of LAC Co., Ltd. as the original reporter of CVE-2011-2522; and the Debian Security Team acknowledges Ronald Volgers as the original reporter of CVE-2010-0787.

Users of Samba are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. After installing this update, the smb service will be restarted automatically.

This is an update that fixes a problem with handling embedded newlines in share names or mountpoints.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

With enabled 'wide links' samba follows symbolic links on the server side, therefore allowing clients to overwrite arbitrary files (CVE-2010-0926). This update changes the default setting to have 'wide links' disabled by default. The new default only works if 'wide links' is not set explicitly in smb.conf.

Due to a race condition in mount.cifs a local attacker could corrupt /etc/mtab if mount.cifs is installed setuid root. mount.cifs is not setuid root by default and it's not recommended to change that.
(CVE-2010-0547)

Multiple vulnerabilies has been found and corrected in samba :

client/mount.cifs.c in mount.cifs in smbfs in Samba does not verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which allows local users to cause a denial of service (mtab corruption) via a crafted string (CVE-2010-0547).

client/mount.cifs.c in mount.cifs in smbfs in Samba allows local users to mount a CIFS share on an arbitrary mountpoint, and gain privileges, via a symlink attack on the mountpoint directory file (CVE-2010-0787).

The updated packages have been patched to correct these issues.

Update :

It was discovered that the previous Samba update required libtalloc from Samba4 package. Therefore, this update provides the required packages in order to fix the issue.

With enabled 'wide links' samba follows symbolic links on the server side, therefore allowing clients to overwrite arbitrary files (CVE-2010-0926). This update changes the default setting to have 'wide links' disabled by default. The new default only works if 'wide links' is not set explicitly in smb.conf.

Due to a race condition in mount.cifs a local attacker could corrupt /etc/mtab if mount.cifs is installed setuid root. mount.cifs is not setuid root by default and it's not recommended to change that (CVE-2010-0547).

With enabled 'wide links' Samba follows symbolic links on the server side, therefore allowing clients to overwrite arbitrary files (CVE-2010-0926). This update changes the default setting to have 'wide links' disabled by default. The new default only works if 'wide links' is not set explicitly in smb.conf.

Due to a race condition in mount.cifs a local attacker could corrupt /etc/mtab if mount.cifs is installed setuid root. mount.cifs is not setuid root by default and it's not recommended to change that.
(CVE-2010-0547)

Two local vulnerabilities have been discovered in samba, a SMB/CIFS file, print, and login server for Unix. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-3297     Ronald Volgers discovered that a race condition in     mount.cifs allows local users to mount remote     filesystems over arbitrary mount points.

  - CVE-2010-0547     Jeff Layton discovered that missing input sanitising in     mount.cifs allows denial of service by corrupting     /etc/mtab.

ID	Name	Product	Family	Severity
89105	VMware ESX / ESXi Service Console and Third-Party Libraries Multiple Vulnerabilities (VMSA-2012-0001) (remote check)	Nessus	Misc.	high
68335	Oracle Linux 5 : samba (ELSA-2011-1219)	Nessus	Oracle Linux Local Security Checks	medium
61123	Scientific Linux Security Update : samba on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
61121	Scientific Linux Security Update : samba3x on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
59702	GLSA-201206-29 : mount-cifs: Multiple vulnerabilites	Nessus	Gentoo Local Security Checks	medium
57749	VMSA-2012-0001 : VMware ESXi and ESX updates to third-party library and ESX Service Console	Nessus	VMware ESX Local Security Checks	high
56272	CentOS 5 : samba3x (CESA-2011:1220)	Nessus	CentOS Local Security Checks	medium
56001	RHEL 6 : samba and cifs-utils (RHSA-2011:1221)	Nessus	Red Hat Local Security Checks	medium
56000	RHEL 5 : samba3x (RHSA-2011:1220)	Nessus	Red Hat Local Security Checks	medium
55999	RHEL 4 / 5 : samba (RHSA-2011:1219)	Nessus	Red Hat Local Security Checks	medium
55997	CentOS 4 / 5 : samba (CESA-2011:1219)	Nessus	CentOS Local Security Checks	medium
55944	Fedora 16 : cifs-utils-5.0-2.fc16 (2011-10028)	Nessus	Fedora Local Security Checks	low
55780	Fedora 14 : cifs-utils-4.8.1-7.fc14 (2011-9847)	Nessus	Fedora Local Security Checks	low
55778	Fedora 15 : cifs-utils-5.0-2.fc15 (2011-9831)	Nessus	Fedora Local Security Checks	low
49834	SuSE 10 Security Update : Samba (ZYPP Patch Number 6921)	Nessus	SuSE Local Security Checks	low
46227	Mandriva Linux Security Advisory : samba (MDVSA-2010:090-1)	Nessus	Mandriva Local Security Checks	medium
45471	SuSE 10 Security Update : Samba (ZYPP Patch Number 6920)	Nessus	SuSE Local Security Checks	low
45453	SuSE9 Security Update : Samba (YOU Patch Number 12595)	Nessus	SuSE Local Security Checks	low
45341	openSUSE Security Update : cifs-mount (cifs-mount-2128)	Nessus	SuSE Local Security Checks	low
45340	openSUSE Security Update : cifs-mount (cifs-mount-2128)	Nessus	SuSE Local Security Checks	low
45339	openSUSE Security Update : cifs-mount (cifs-mount-2128)	Nessus	SuSE Local Security Checks	low
45130	SuSE 11 Security Update : Samba (SAT Patch Number 2126)	Nessus	SuSE Local Security Checks	low
44950	Debian DSA-2004-1 : samba - several vulnerabilities	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2010-0547

medium

Tenable Plugins

high

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

low

low

low

low

medium

low

low

low

low

low

low

medium