CVE-2011-2724: Input Validation
Originally the CVE-2010-0547 identifier has been assigned by Common Vulnerabilities and Exposures to the following security issue:
client/mount.cifs.c in mount.cifs in smbfs in Samba 3.4.5 and earlier does not verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which allows local users to cause a denial of service (mtab corruption) via a crafted string.
Later a bug was found in the upstream patch for this issue. More specifically:
checkmtab() calls checknewline() to check device and directory name. checknewline() returns EXUSAGE (1) when error is detected, while checkmtab() expects -1 to indicate an error.
This bug in original CVE-2010-0547 fix (not to propagate the error properly) caused mount.cifs command on specially-crafted mount point (containing newline character) still to succeed and potentially, to corrupt mtab table on the systems, where CVE-2010-0296 glibc fix was not applied yet.
Proposed upstream patch by Jeff Layton: [1] http://thread.gmane.org/gmane.linux.kernel.cifs/3827
Other sources
The checkmtab function in client/mount.cifs.c in mount.cifs in smbfs in Samba 3.5.10 and earlier does not properly verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which allows local users to cause a denial of service (mtab corruption) via a crafted string. NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-0547.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2724?
The severity of CVE-2011-2724 is classified as medium risk due to potential unauthorized access issues.
How do I fix CVE-2011-2724?
To fix CVE-2011-2724, upgrade to a version of Samba later than 3.5.10.
What versions of Samba are affected by CVE-2011-2724?
CVE-2011-2724 affects Samba versions 3.4.5 and earlier, along with various earlier versions including 2.x and 1.x.
What kind of attack is possible with CVE-2011-2724?
CVE-2011-2724 allows attackers to exploit unchecked paths leading to unauthorized access to file systems.
Is there a specific patch available for CVE-2011-2724?
Yes, the recommended action is to install the latest security patches or upgrade to a safe Samba version.