vulnerability CVE-2010-0787

Samba: privilege elevation via mount.cifs

Synthesis of the vulnerability

When the mount.cifs tool is installed suid root, a local attacker can use a symbolic link, in order to elevate his privileges or to obtain information.

Severity: 2/4. Creation date: 29/01/2010.

Description of the vulnerability

The mount.cifs utility of the Samba suite is used to mount a remote CIFS/SMB share in a local directory. This tool is frequently installed suid root. However, this tool does not atomically check the mount directory. A local attacker can therefore:  - call mount.cifs to mount a remote share on /home/user/mydir  - during its execution, replace /home/user/mydir by a symbolic link to /privatedirectory  - wait for mount.cifs to mount the share on /privatedirectory So, by modifying/reading the content of the share on the remote server, the local attacker can modify/read to content of /privatedirectory. When the mount.cifs tool is installed suid root, a local attacker can therefore use a symbolic link, in order to elevate his privileges or to obtain information.

Complete Vigil@nce bulletin

Access to the complete Vigil@nce bulletin

Characteristics

Title: Samba: privilege elevation via mount.cifs. Keywords: CIFS SMB Samba cifs elevation mount privilege. Identifiers: 532940, 6853, BID-37992, BID-39898, CVE-2010-0787, DSA 2004-1, ERR-2010-0747, FEDORA-2010-1190, FEDORA-2010-1218, MDVSA-2010:090, MDVSA-2010:090-1, REJ-2009-3297, SUSE-SA:2010:025, SUSE-SR:2010:004, SUSE-SR:2010:014, VIGILANCE-VUL-9390.

Information sources

Publications and announces Source example: CVE-2009-3297 samba, fuse, ncpfs: Race condition by mount (mount.cifs, ncpmount) / umount (fusermount, ncpumount) operations

Solutions for this vulnerability

Patch or workaround

Supplements

Attack Exploit 0day or proof of concept

Computer vulnerabilities tracking service

The Vigil@nce computer vulnerability tracking service alerts your teams of vulnerabilities or threats impacting your information system.
The Vigil@nce vulnerability database contains several thousand vulnerabilities.
This bulletin is published by the Vigil@nce team, which tracks computer vulnerabilities impacting systems and applications.
Computer vulnerability database