Mandrake Linux Security Advisory : fuse (MDKSA-2005:216)

low Nessus Plugin ID 20448

Synopsis

The remote Mandrake Linux host is missing one or more security updates.

Description

Thomas Beige found that fusermount failed to securely handle special characters specified in mount points, which could allow a local attacker to corrupt the contents of /etc/mtab by mounting over a maliciously-named directory using fusermount. This could potentially allow the attacker to set unauthorized mount options.

This is only possible when fusermount is installed setuid root, which is the case in Mandriva Linux.

The updated packages have been patched to address these problems.

Solution

Update the affected packages.

Plugin Details

Severity: Low

ID: 20448

File Name: mandrake_MDKSA-2005-216.nasl

Version: 1.14

Type: local

Family: Mandriva Local Security Checks

Published: 1/15/2006

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.4

CVSS v2

Risk Factor: Low

Base Score: 2.1

Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:dkms-fuse, p-cpe:/a:mandriva:linux:fuse, p-cpe:/a:mandriva:linux:lib64fuse2, p-cpe:/a:mandriva:linux:lib64fuse2-devel, p-cpe:/a:mandriva:linux:lib64fuse2-static-devel, p-cpe:/a:mandriva:linux:libfuse2, p-cpe:/a:mandriva:linux:libfuse2-devel, p-cpe:/a:mandriva:linux:libfuse2-static-devel, cpe:/o:mandriva:linux:2006

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Patch Publication Date: 11/24/2005

Reference Information

CVE: CVE-2005-3531

MDKSA: 2005:216

Detections

Analytics