vulnerability CVE-2010-0296 CVE-2010-0547

Samba: corruption of mtab via mount.cifs

Synthesis of the vulnerability

A local attacker can use the mount.cifs command, in order to inject invalid characters in the /etc/mtab file.

Severity: 1/4. Creation date: 08/02/2010.

Description of the vulnerability

The mount.cifs utility of the Samba suite is used to mount a remote CIFS/SMB share in a local directory. The /etc/mtab file contains the list of mount points. This file is updated each time a new resource is mounted by mount.cifs. However, mount.cifs does not check if the device or mount point name contains a special character (line feed, tabulation, etc.). This invalid character is inserted in the /etc/mtab file, which corrupts it. A local attacker can therefore use the mount.cifs command, in order to inject invalid characters in the /etc/mtab file, which leads to a denial of service.

Complete Vigil@nce bulletin

Access to the complete Vigil@nce bulletin

Characteristics

Title: Samba: corruption of mtab via mount.cifs. Keywords: CIFS SMB Samba cifs corruption mount mtab. Identifiers: BID-38326, CVE-2010-0296, CVE-2010-0547, DSA 2004-1, DSA 2058-1, MDVSA-2010:090, MDVSA-2010:090-1, MDVSA-2010:111, MDVSA-2010:112, SUSE-SR:2010:007, SUSE-SR:2010:008, VIGILANCE-VUL-9415.

Information sources

Publications and announces Source example: mount.cifs: check for invalid characters in device name and mountpoint

Solutions for this vulnerability

Patch or workaround

Supplements

Attack Exploit 0day or proof of concept

Computer vulnerabilities tracking service

The Vigil@nce computer vulnerability tracking service alerts your teams of vulnerabilities or threats impacting your information system.
The Vigil@nce vulnerability database contains several thousand vulnerabilities.
This bulletin is published by the Vigil@nce team, which tracks computer vulnerabilities impacting systems and applications.
Computer vulnerabilities tracking service