CVE-2007-5191
First published: Thu Sep 20 2007(Updated: )
Common Vulnerabilities and Exposures assigned an identifier <a href="https://access.redhat.com/security/cve/CVE-2007-5191">CVE-2007-5191</a> to the following vulnerability: mount and umount in util-linux call the setuid and setgid functions in the wrong order and do not check the return values, which might allow attackers to gain privileges via helpers such as mount.nfs. References: <a href="http://git.kernel.org/?p=utils/util-linux-ng/util-linux-ng.git;a=commit;h=ebbeb2c7ac1b00b6083905957837a271e80b187e">http://git.kernel.org/?p=utils/util-linux-ng/util-linux-ng.git;a=commit;h=ebbeb2c7ac1b00b6083905957837a271e80b187e</a>
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Kernel Util-linux | <=2.13.1.1 | |
| Loop-aes-utils Project Loop-aes-utils | ||
| Fedoraproject Fedora | =7 | |
| Canonical Ubuntu Linux | =7.04 | |
| Canonical Ubuntu Linux | =6.10 | |
| Canonical Ubuntu Linux | =6.06 | |
| Debian Debian Linux | =3.1 | |
| redhat/2.13 | <0.54.1. | 0.54.1. |
| redhat/util-linux | <0:2.12a-17.el4_6.1 | 0:2.12a-17.el4_6.1 |
| redhat/util-linux | <0:2.13-0.45.el5_1.1 | 0:2.13-0.45.el5_1.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://bugs.gentoo.org/show_bug.cgi?id=195390
- http://frontal2.mandriva.com/en/security/advisories?name=MDKSA-2007:198
- http://git.kernel.org/?p=utils/util-linux-ng/util-linux-ng.git%3Ba=commit%3Bh=ebbeb2c7ac1b00b6083905957837a271e80b187e
- http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00008.html
- http://lists.vmware.com/pipermail/security-announce/2008/000002.html
- http://secunia.com/advisories/27104
- http://secunia.com/advisories/27122
- http://secunia.com/advisories/27145
- http://secunia.com/advisories/27188
- http://secunia.com/advisories/27283
- http://secunia.com/advisories/27354
- http://secunia.com/advisories/27399
- http://secunia.com/advisories/27687
- http://secunia.com/advisories/28348
- http://secunia.com/advisories/28349
- http://secunia.com/advisories/28368
- http://secunia.com/advisories/28469
- http://security.gentoo.org/glsa/glsa-200710-18.xml
- http://support.avaya.com/elmodocs2/security/ASA-2008-023.htm
- http://www.debian.org/security/2008/dsa-1449
- http://www.debian.org/security/2008/dsa-1450
- http://www.redhat.com/support/errata/RHSA-2007-0969.html
- http://www.securityfocus.com/archive/1/485936/100/0/threaded
- http://www.securityfocus.com/archive/1/486859/100/0/threaded
- http://www.securityfocus.com/bid/25973
- http://www.securitytracker.com/id?1018782
- http://www.ubuntu.com/usn/usn-533-1
- http://www.vmware.com/security/advisories/VMSA-2008-0001.html
- http://www.vupen.com/english/advisories/2007/3417
- http://www.vupen.com/english/advisories/2008/0064
- https://bugzilla.redhat.com/show_bug.cgi?id=320041
- https://issues.rpath.com/browse/RPL-1757
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10101
- https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00144.html
- http://git.kernel.org/?p=utils/util-linux-ng/util-linux-ng.git;a=commit;h=ebbeb2c7ac1b00b6083905957837a271e80b187e
- https://access.redhat.com/security/cve/CVE-2007-5191
- http://rhn.redhat.com/errata/RHSA-2007-0969.html
- https://admin.fedoraproject.org/updates/F7/FEDORA-2007-2462
- https://www.cve.org/CVERecord?id=CVE-2007-5191 https://nvd.nist.gov/vuln/detail/CVE-2007-5191
- https://access.redhat.com/errata/RHSA-2007:0969
- https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2007-5191.json
- collector/nvd-historical
- collector/nvd-index
- collector/nvd-api
- agent/author
- agent/type
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/references
- agent/weakness
- agent/severity
- agent/description
- collector/redhat-cve
- source/Red Hat
- agent/software-canonical-lookup
- collector/redhat-bugzilla
- alias/CVE-2007-5191
- agent/tags
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/kernel
- canonical/kernel util-linux
- version/kernel util-linux/2.13.1.1
- vendor/loop-aes-utils project
- canonical/loop-aes-utils project loop-aes-utils
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/7
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/7.04
- version/canonical ubuntu linux/6.10
- version/canonical ubuntu linux/6.06
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/3.1
- package-manager/redhat