mount.cifs in cifs-utils 2.6 allows local users to determine the existence of arbitrary files or directories via the file path in the second argument, which reveals their existence in an error message.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - cifs-utils: stack-based buffer overflow flaw in pam_cifscreds (CVE-2014-2830)

  - samba: symlink race permits opening files outside share directory (CVE-2017-2619)

  - mount.cifs in cifs-utils 2.6 allows local users to determine the existence of arbitrary files or     directories via the file path in the second argument, which reveals their existence in an error message.
    (CVE-2012-1586)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The Samba Web Administration Tool (SWAT) in Samba versions 3.0.x to 4.0.1 was affected by a cross-site request forgery (CVE-2013-0214) and a click-jacking attack (CVE-2013-0213). This has been fixed.

Additionally a bug in mount.cifs has been fixed which could have lead to file disclosure (CVE-2012-1586).

Also a uninitialized memory read bug in talloc_free() has been fixed.
(bnc#764577).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

mount.cifs could leak information about existence of files normally not accessible to users

The remote Oracle Linux 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2012-0902 advisory.

    [4.8.1-10]
    - mount.cifs: don't allow unprivileged users to mount onto dirs they can't chdir into (bz 812782)

    [4.8.1-9]
    - cifs.upcall: use krb5_sname_to_principal to construct principal name (bz 805490)

    [4.8.1-8]
    - mount.cifs: add backupuid=/backupgid= mount options (bz 806337)

    [4.8.1-7]
    - RFE: Improve selection of SPNs with cifs.upcall (bz 748757)
    - mount.cifs does not use KRB5_CONFIG (bz 748756)     [creates additional entries in /etc/mtab (bz 770004)]
    - mount.cifs does not honor the uid/gid=username option, only the uid/gid=# option (bz 796463)

    [4.8.1-6]
    - undocumented mount.cifs options (bz 769923)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Samba Web Administration Tool (SWAT) in Samba versions 3.0.x to 4.0.1 was affected by a cross-site request forgery (CVE-2013-0214) and a click-jacking attack (CVE-2013-0213). This has been fixed.

Additionally a bug in mount.cifs has been fixed which could have lead to file disclosure. (CVE-2012-1586)

Also a uninitialized memory read bug in talloc_free() has been fixed.
. (bnc#764577)

The cifs-utils package contains tools for mounting and managing shares on Linux using the SMB/CIFS protocol. The CIFS shares can be used as standard Linux file systems.

A file existence disclosure flaw was found in mount.cifs. If the tool was installed with the setuid bit set, a local attacker could use this flaw to determine the existence of files or directories in directories not accessible to the attacker. (CVE-2012-1586)

Note: mount.cifs from the cifs-utils package distributed by Scientific Linux does not have the setuid bit set. We recommend that administrators do not manually set the setuid bit for mount.cifs.

This update also fixes the following bugs :

  - The cifs.mount(8) manual page was previously missing     documentation for several mount options. With this     update, the missing entries have been added to the     manual page.

  - Previously, the mount.cifs utility did not properly     update the '/etc/mtab' system information file when     remounting an existing CIFS mount. Consequently,     mount.cifs created a duplicate entry of the existing     mount entry. This update adds the del_mtab() function to     cifs.mount, which ensures that the old mount entry is     removed from '/etc/mtab' before adding the updated mount     entry.

  - The mount.cifs utility did not properly convert user and     group names to numeric UIDs and GIDs. Therefore, when     the 'uid', 'gid' or 'cruid' mount options were specified     with user or group names, CIFS shares were mounted with     default values. This caused shares to be inaccessible to     the intended users because UID and GID is set to '0' by     default. With this update, user and group names are     properly converted so that CIFS shares are now mounted     with specified user and group ownership as expected.

  - The cifs.upcall utility did not respect the     'domain_realm' section in the 'krb5.conf' file and     worked only with the default domain. Consequently, an     attempt to mount a CIFS share from a different than the     default domain failed with the following error message :

    mount error(126): Required key not available

This update modifies the underlying code so that cifs.upcall handles multiple Kerberos domains correctly and CIFS shares can now be mounted as expected in a multi-domain environment.

In addition, this update adds the following enhancements :

  - The cifs.upcall utility previously always used the     '/etc/krb5.conf' file regardless of whether the user had     specified a custom Kerberos configuration file. This     update adds the '--krb5conf' option to cifs.upcall     allowing the administrator to specify an alternate     krb5.conf file. For more information on this option,     refer to the cifs.upcall(8) manual page.

  - The cifs.upcall utility did not optimally determine the     correct service principal name (SPN) used for Kerberos     authentication, which occasionally caused krb5     authentication to fail when mounting a server's     unqualified domain name. This update improves     cifs.upcall so that the method used to determine the SPN     is now more versatile.

  - This update adds the 'backupuid' and 'backupgid' mount     options to the mount.cifs utility. When specified, these     options grant a user or a group the right to access     files with the backup intent. For more information on     these options, refer to the mount.cifs(8) manual page.

All users of cifs-utils are advised to upgrade to this updated package, which contains backported patches to fix these issues and add these enhancements.

An updated cifs-utils package that fixes one security issue, multiple bugs, and adds various enhancements is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The cifs-utils package contains tools for mounting and managing shares on Linux using the SMB/CIFS protocol. The CIFS shares can be used as standard Linux file systems.

A file existence disclosure flaw was found in mount.cifs. If the tool was installed with the setuid bit set, a local attacker could use this flaw to determine the existence of files or directories in directories not accessible to the attacker. (CVE-2012-1586)

Note: mount.cifs from the cifs-utils package distributed by Red Hat does not have the setuid bit set. We recommend that administrators do not manually set the setuid bit for mount.cifs.

This update also fixes the following bugs :

* The cifs.mount(8) manual page was previously missing documentation for several mount options. With this update, the missing entries have been added to the manual page. (BZ#769923)

* Previously, the mount.cifs utility did not properly update the '/etc/mtab' system information file when remounting an existing CIFS mount. Consequently, mount.cifs created a duplicate entry of the existing mount entry. This update adds the del_mtab() function to cifs.mount, which ensures that the old mount entry is removed from '/etc/mtab' before adding the updated mount entry. (BZ#770004)

* The mount.cifs utility did not properly convert user and group names to numeric UIDs and GIDs. Therefore, when the 'uid', 'gid' or 'cruid' mount options were specified with user or group names, CIFS shares were mounted with default values. This caused shares to be inaccessible to the intended users because UID and GID is set to '0' by default. With this update, user and group names are properly converted so that CIFS shares are now mounted with specified user and group ownership as expected. (BZ#796463)

* The cifs.upcall utility did not respect the 'domain_realm' section in the 'krb5.conf' file and worked only with the default domain.
Consequently, an attempt to mount a CIFS share from a different than the default domain failed with the following error message :

mount error(126): Required key not available

This update modifies the underlying code so that cifs.upcall handles multiple Kerberos domains correctly and CIFS shares can now be mounted as expected in a multi-domain environment. (BZ#805490)

In addition, this update adds the following enhancements :

* The cifs.upcall utility previously always used the '/etc/krb5.conf' file regardless of whether the user had specified a custom Kerberos configuration file. This update adds the '--krb5conf' option to cifs.upcall allowing the administrator to specify an alternate krb5.conf file. For more information on this option, refer to the cifs.upcall(8) manual page. (BZ#748756)

* The cifs.upcall utility did not optimally determine the correct service principal name (SPN) used for Kerberos authentication, which occasionally caused krb5 authentication to fail when mounting a server's unqualified domain name. This update improves cifs.upcall so that the method used to determine the SPN is now more versatile.
(BZ#748757)

* This update adds the 'backupuid' and 'backupgid' mount options to the mount.cifs utility. When specified, these options grant a user or a group the right to access files with the backup intent. For more information on these options, refer to the mount.cifs(8) manual page.
(BZ#806337)

All users of cifs-utils are advised to upgrade to this updated package, which contains backported patches to fix these issues and add these enhancements.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2012:0902 advisory.

  - samba / cifs-utils: mount.cifs file existence disclosure vulnerability (CVE-2012-1586)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A vulnerability has been found and corrected in samba :

A file existence dislosure flaw was found in the way mount.cifs tool of the Samba SMB/CIFS tools suite performed mount of a Linux CIFS (Common Internet File System) filesystem. A local user, able to mount a remote CIFS share / target to a local directory could use this flaw to confirm (non) existence of a file system object (file, directory or process descriptor) via error messages generated during the mount.cifs tool run (CVE-2012-1586).

The updated packages have been patched to correct this issue.

A vulnerability has been found and corrected in cifs-utils :

A file existence dislosure flaw was found in the way mount.cifs tool of the Samba SMB/CIFS tools suite performed mount of a Linux CIFS (Common Internet File System) filesystem. A local user, able to mount a remote CIFS share / target to a local directory could use this flaw to confirm (non) existence of a file system object (file, directory or process descriptor) via error messages generated during the mount.cifs tool run (CVE-2012-1586).

The updated packages have been patched to correct this issue.

This updates the cifs-utils package to version 5.4, which contains a number of bugfixes and enhancements. Highlights include :

  - mount.cifs now supports the -s option by passing     'sloppy' to the kernel in the options string

  - cifs.upcall now properly respects the domain_realm     section in krb5.conf

  - unprivileged users can no longer mount onto dirs into     which they can't chdir (fixes CVE-2012-1586)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The following issue has been fixed :

  - Don't allow unprivileged users to mount onto dirs to     which they can't chdir. (CVE-2012-1586)

This update of Samba includes the following fixes for two security issues :

  - Ensure that users cannot hand out their own privileges     to everyone, only administrators are allowed to do that.
    (CVE-2012-2111)

  - mount.cifs no longer allows unprivileged users to mount     onto dirs that are not accessible to them.
    (CVE-2012-1586)

This updates the cifs-utils package to version 5.4, which contains a number of bugfixes and enhancements. Highlights include :

  - mount.cifs now supports the -s option by passing     'sloppy' to the kernel in the options string

  - cifs.upcall now properly respects the domain_realm     section in krb5.conf

  - unprivileged users can no longer mount onto dirs into     which they can't chdir (fixes CVE-2012-1586)

  - the cifscreds, getcifsacl and setcifsacl programs have     been added to the package

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199740	RHEL 5 : samba (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
83575	SUSE SLED10 / SLES10 Security Update : Samba (SUSE-SU-2013:0325-1)	Nessus	SuSE Local Security Checks	medium
74619	openSUSE Security Update : cifs-utils (openSUSE-SU-2012:0607-1)	Nessus	SuSE Local Security Checks	low
68560	Oracle Linux 6 : cifs-utils (ELSA-2012-0902)	Nessus	Oracle Linux Local Security Checks	low
64865	SuSE 10 Security Update : Samba (ZYPP Patch Number 8449)	Nessus	SuSE Local Security Checks	medium
61338	Scientific Linux Security Update : cifs-utils on SL6.x i386/x86_64 (20120620)	Nessus	Scientific Linux Local Security Checks	low
59931	CentOS 6 : cifs-utils (CESA-2012:0902)	Nessus	CentOS Local Security Checks	low
59596	RHEL 6 : cifs-utils (RHSA-2012:0902)	Nessus	Red Hat Local Security Checks	low
59012	Mandriva Linux Security Advisory : samba (MDVSA-2012:070)	Nessus	Mandriva Local Security Checks	low
59011	Mandriva Linux Security Advisory : cifs-utils (MDVSA-2012:069)	Nessus	Mandriva Local Security Checks	low
58958	Fedora 17 : cifs-utils-5.4-1.fc17 (2012-6257)	Nessus	Fedora Local Security Checks	low
58942	SuSE 11.2 Security Update : cifs-utils (SAT Patch Number 6196)	Nessus	SuSE Local Security Checks	low
58941	SuSE 11.1 Security Update : Samba (SAT Patch Number 6210)	Nessus	SuSE Local Security Checks	medium
58932	Fedora 15 : cifs-utils-5.4-1.fc15 (2012-6398)	Nessus	Fedora Local Security Checks	low
58930	Fedora 16 : cifs-utils-5.4-1.fc16 (2012-6375)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2012-1586

low

Tenable Plugins

high

medium

low

low

medium

low

low

low

low

low

low

low

medium

low

low