CVE-2010-2524
First published: Wed Jul 07 2010(Updated: )
Description of problem: CIFS has the ability to chase MS-DFS referrals. In order to do this it has to be able to resolve hostnames into IP addresses. For this, it uses the keys API to upcall to the cifs.upcall userspace helper. It then resolves the name and hands the address back to the kernel. The dns_resolver upcall currently used by CIFS is susceptible to cache stuffing. It's possible for a malicious user to stuff the keyring with the results of a lookup, and then trick the server into mounting a server of his choosing.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/linux-2.6 | ||
| Linux Linux kernel | <2.6.35 | |
| VMware ESX | =4.0 | |
| VMware ESX | =4.1 | |
| Canonical Ubuntu Linux | =6.06 | |
| Canonical Ubuntu Linux | =8.04 | |
| Canonical Ubuntu Linux | =9.04 | |
| Canonical Ubuntu Linux | =9.10 | |
| Canonical Ubuntu Linux | =10.04 | |
| Canonical Ubuntu Linux | =10.10 | |
| SUSE SUSE Linux Enterprise Desktop | =11-sp1 | |
| SUSE SUSE Linux Enterprise Server | =11-sp1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/archive/1/516397/100/0/threaded
- http://secunia.com/advisories/43315
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:172
- https://bugzilla.redhat.com/show_bug.cgi?id=612166
- http://www.redhat.com/support/errata/RHSA-2010-0610.html
- http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00004.html
- http://www.ubuntu.com/usn/USN-1000-1
- http://marc.info/?l=oss-security&m=128072090331700&w=2
- http://marc.info/?l=oss-security&m=128078387328921&w=2
- http://marc.info/?l=oss-security&m=128080755321157&w=2
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=4c0c03ca54f72fdd5912516ad0a23ec5cf01bda7
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.35
- http://www.vmware.com/security/advisories/VMSA-2011-0003.html
- https://launchpad.net/bugs/cve/CVE-2010-2524
- https://rhn.redhat.com/errata/RHSA-2010-0723.html
- http://git.kernel.org/linus/4c0c03ca54f72fdd5912516ad0a23ec5cf01bda7
- https://rhn.redhat.com/errata/RHSA-2010-0610.html
- https://security-tracker.debian.org/tracker/CVE-2010-2524
- http://marc.info/?l=oss-security&m=128072090331700&w=2
- http://marc.info/?l=oss-security&m=128078387328921&w=2
- http://marc.info/?l=oss-security&m=128080755321157&w=2
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2524
- https://nvd.nist.gov/vuln/detail/CVE-2010-2524
- https://ubuntu.com/security/CVE-2010-2524
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2010-2524
- agent/author
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- collector/mitre-cve
- source/MITRE
- collector/usn-cve
- source/Ubuntu
- agent/remedy
- agent/references
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- collector/nvd-cve
- source/NVD
- agent/last-modified-date
- agent/trending
- package-manager/debian
- vendor/linux
- canonical/linux linux kernel
- vendor/vmware
- canonical/vmware esx
- version/vmware esx/4.0
- version/vmware esx/4.1
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/6.06
- version/canonical ubuntu linux/8.04
- version/canonical ubuntu linux/9.04
- version/canonical ubuntu linux/9.10
- version/canonical ubuntu linux/10.04
- version/canonical ubuntu linux/10.10
- vendor/suse
- canonical/suse suse linux enterprise desktop
- version/suse suse linux enterprise desktop/11-sp1
- canonical/suse suse linux enterprise server
- version/suse suse linux enterprise server/11-sp1