CVE-2010-0788: Race Condition
ncpfs 2.2.6 allows local users to cause a denial of service, obtain sensitive information, or possibly gain privileges via symlink attacks involving the (1) ncpmount and (2) ncpumount programs.
Other sources
Several race condition flaws were found in samba-client, fuse and ncpfs packages:
a, Ronald Volgers found a race condition in the samba-client's mount.cifs utility. Local, unprivileged user could use this flaw to conduct symlink attacks, leading to disclosure of sensitive information, or, possibly to privilege escalation.
Upstream bug report: https://bugzilla.samba.org/showbug.cgi?id=6853
Upstream Samba patches: http://git.samba.org/?p=samba.git;a=commit;h=3ae5dac462c4ed0fb2cd94553583c56fce2f9d80 http://git.samba.org/?p=samba.git;a=commit;h=a065c177dfc8f968775593ba00dffafeebb2e054 http://git.samba.org/?p=samba.git;a=commit;h=a0c31ec1c8d1220a5884e40d9ba6b191a04a24d5
Issue severity note for Red Hat Enteprise Linux: ------------------------------------------------
The mount.cifs binary, as shipped within samba-client package on Red Hat Enterprise Linux 4 and 5, is NOT shipped with setuid root bit enabled by default (local, unprivileged users on these systems are NOT able to mount custom CIFS filesystem shares), which mitigates the impact of the vulnera- bility.
b, Dan Rosenberg found a race condition in the FUSE's fusermount's utility by performing FUSE filesystem(s) unmount operation (it was not performed atomically). A local, unprivileged user could use this flaw to cause a denial of service (unprivileged unmount of FUSE filesystem share(s) owned by privileged user) via symlink attack involving FUSE share(s) belonging to privileged user.
Issue severity note for Red Hat Enterprise Linux: -------------------------------------------------
The "fusermount" utility, as shipped within "fuse" package in Red Hat Enterprise Linux 5 IS shipped with setuid root bit enabled by default, but the unprivileged user to be able to mount custom FUSE filesystem, he needs prior to be the member of special "fuse" users group (user membership in this group is granted by privileged user), which mitigates the impact of the vulnerability.
c, Dan Rosenberg found race conditions in the ncpfs ncpmount and ncpumount utilities. Local, unprivileged user could use these flaws to conduct symlink attacks, leading to denial of service (ncpumount), disclosure of sensitive information, or, possibly to privilege escalation (ncpmount).
Issue severity note for Fedora: -------------------------------
The "ncpmount and ncpumount" utilities, as shipped within "ncpfs" package in Fedora release of 11 and 12 are NOT shipped with setuid root bit enabled by default (unprivileged, local users are NOT able to mount / umount custom remote NCP shares), which mitigates the impact of the flaws.
Acknowledgements:
Red Hat would like to thank Dan Rosenberg for responsibly reporting these flaws.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-0788?
CVE-2010-0788 has a medium severity rating as it can lead to denial of service and potential privilege escalation.
How do I fix CVE-2010-0788?
To fix CVE-2010-0788, upgrade to ncpfs version 2.2.7 or later which addresses the vulnerabilities.
What vulnerabilities are associated with CVE-2010-0788?
CVE-2010-0788 is associated with symlink attacks that affect the ncpmount and ncpumount programs of ncpfs 2.2.6.
Who is affected by CVE-2010-0788?
Local users of systems running ncpfs version 2.2.6 are affected by CVE-2010-0788.
Can CVE-2010-0788 lead to privilege escalation?
Yes, CVE-2010-0788 can potentially allow local users to gain elevated privileges through symlink attacks.