fusermount in FUSE before 2.7.5, and 2.8.x before 2.8.2, allows local users to unmount an arbitrary FUSE filesystem share via a symlink attack on a mountpoint.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - fuse: unprivileged user can unmount arbitrary locations via symlink attack (CVE-2010-3879)

  - fuse: incorrect filtering of environment variables leading to privilege escalation (CVE-2015-3202)

  - fusermount in FUSE before 2.7.5, and 2.8.x before 2.8.2, allows local users to unmount an arbitrary FUSE     filesystem share via a symlink attack on a mountpoint. (CVE-2010-0789)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

It was discovered that FUSE would incorrectly follow symlinks when checking mountpoints under certain conditions. A local attacker, with access to use FUSE, could unmount arbitrary locations, leading to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A race condition in fusermount allows non-privileged users to umount any file system. (CVE-2010-0789)

Note: this is a re-release of the previous update with a better patch.

A race condition in fusermount allows non-privileged users to umount any file system. (CVE-2009-3297)

Fixed CVE-2009-3297 (rhbz #558833)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A race condition in fusermount allows non-privileged users to umount any file system (CVE-2010-0789). 

Note: this is a re-release of the previous update with a better patch.

A race condition has been found in fuse that could escalate privileges for local users and lead to a DoS (Denial of Service) (CVE-2010-0789).

The updated packages have been patched to correct this issue.

Dan Rosenberg discovered a race condition in FUSE, a Filesystem in USErspace. A local attacker, with access to use FUSE, could unmount arbitrary locations, leading to a denial of service.

A race condition in fusermount allowed users to umount any filesystem (CVE-2009-3297).

A race condition in fusermount allowed users to umount any filesystem (CVE-2009-3297). This has been fixed.

Dan Rosenberg discovered that FUSE did not correctly check mount locations. A local attacker, with access to use FUSE, could unmount arbitrary locations, leading to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199383	RHEL 5 : fuse (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
52479	Ubuntu 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : fuse vulnerabilities (USN-1077-1)	Nessus	Ubuntu Local Security Checks	low
51743	SuSE 10 Security Update : fuse (ZYPP Patch Number 6888)	Nessus	SuSE Local Security Checks	low
51742	SuSE 10 Security Update : fuse (ZYPP Patch Number 6886)	Nessus	SuSE Local Security Checks	low
51741	SuSE 10 Security Update : fuse (ZYPP Patch Number 6840)	Nessus	SuSE Local Security Checks	low
51740	SuSE 10 Security Update : fuse (ZYPP Patch Number 6838)	Nessus	SuSE Local Security Checks	low
50907	SuSE 11 Security Update : fuse (SAT Patch Number 2078)	Nessus	SuSE Local Security Checks	low
47236	Fedora 12 : fuse-2.8.1-4.fc12 (2010-1159)	Nessus	Fedora Local Security Checks	low
47233	Fedora 11 : fuse-2.8.1-2.fc11 (2010-1140)	Nessus	Fedora Local Security Checks	low
46210	openSUSE Security Update : fuse (openSUSE-SU-2010:0187-1)	Nessus	SuSE Local Security Checks	low
46208	openSUSE Security Update : fuse (openSUSE-SU-2010:0187-1)	Nessus	SuSE Local Security Checks	low
46206	openSUSE Security Update : fuse (openSUSE-SU-2010:0187-1)	Nessus	SuSE Local Security Checks	low
44870	Mandriva Linux Security Advisory : fuse (MDVSA-2010:047)	Nessus	Mandriva Local Security Checks	low
44853	Debian DSA-1989-1 : fuse - denial of service	Nessus	Debian Local Security Checks	low
44616	openSUSE Security Update : fuse (fuse-1897)	Nessus	SuSE Local Security Checks	low
44611	openSUSE Security Update : fuse (fuse-1897)	Nessus	SuSE Local Security Checks	low
44606	openSUSE Security Update : fuse (fuse-1897)	Nessus	SuSE Local Security Checks	low
44389	SuSE 11 Security Update : fuse (SAT Patch Number 1867)	Nessus	SuSE Local Security Checks	low
44335	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : fuse vulnerability (USN-892-1)	Nessus	Ubuntu Local Security Checks	low

Detections

Analytics

CVE-2010-0789

high

Tenable Plugins

critical

low

low

low

low

low

low

low

low

low

low

low

low

low

low

low

low

low

low