CVE-2011-3585: Race Condition
First published: Mon Oct 03 2011(Updated: )
A race condition was found in the way 'mount.cifs' and 'umount.cifs' utilities performed mount / umount of a particular CIFS share to / from specified mount point (/etc/mtab~ lockfile was created before updating the /etc/mtab file and deleted once the operation completed), when these utilies were setuid root enabled. A local attacker could use this flaw to conduct denial of service attacks (failure of subsequent CIFS share umount / mount requests) by sending termination signal to 'mount.cifs' / 'umount.cifs' processes in the moment of existence of a stale (/etc/mtab~) lockfile. References: [1] <a href="https://bugzilla.samba.org/show_bug.cgi?id=7179">https://bugzilla.samba.org/show_bug.cgi?id=7179</a> (upstream bug report) [2] <a href="http://git.samba.org/?p=cifs-utils.git;a=commitdiff;h=810f7e4e0f2dbcbee0294d9b371071cb08268200">http://git.samba.org/?p=cifs-utils.git;a=commitdiff;h=810f7e4e0f2dbcbee0294d9b371071cb08268200</a> (upstream patch) [3] <a href="http://www.openwall.com/lists/oss-security/2011/09/27/1">http://www.openwall.com/lists/oss-security/2011/09/27/1</a> (CVE request) [4] <a href="http://www.openwall.com/lists/oss-security/2011/09/30/5">http://www.openwall.com/lists/oss-security/2011/09/30/5</a> (CVE assignment) Note: This flaw to be exploitable as described above requires the 'mount.cifs' / 'umount.cifs' utilities to be setuid root enabled. These utilities are not setuid root enabled on Red Hat Enterprise Linux and Fedora distributions, and thus these distributions as such are not vulnerable to this flaw.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Samba Samba | =3.6.0 | |
| Redhat Enterprise Linux | =4.0 | |
| Redhat Enterprise Linux | =6.0 | |
| Redhat Enterprise Linux | =5.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.samba.org/show_bug.cgi?id=7179
- http://git.samba.org/?p=cifs-utils.git;a=commitdiff;h=810f7e4e0f2dbcbee0294d9b371071cb08268200
- http://www.openwall.com/lists/oss-security/2011/09/27/1
- http://www.openwall.com/lists/oss-security/2011/09/30/5
- https://rhn.redhat.com/errata/RHSA-2011-1219.html
- https://rhn.redhat.com/errata/RHSA-2011-1221.html
- https://bugzilla.redhat.com/show_bug.cgi?id=742907
- https://www.openwall.com/lists/oss-security/2011/09/27/1
- https://www.openwall.com/lists/oss-security/2011/09/30/5
- https://git.samba.org/?p=cifs-utils.git%3Ba=commitdiff%3Bh=810f7e4e0f2dbcbee0294d9b371071cb08268200
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2011-3585.
What is the severity of CVE-2011-3585?
The severity of CVE-2011-3585 is medium.
What software is affected by CVE-2011-3585?
The affected software includes Samba 3.6.0, Redhat Enterprise Linux 4.0, 6.0, and 5.0.
How can local users exploit CVE-2011-3585?
Local users can exploit CVE-2011-3585 by sending a SIGKILL signal during a time window when the /etc/mtab~ file exists.
Are there any references for CVE-2011-3585?
Yes, you can find references for CVE-2011-3585 at the following links: [link1](https://bugzilla.redhat.com/show_bug.cgi?id=742907), [link2](https://www.openwall.com/lists/oss-security/2011/09/27/1), [link3](https://www.openwall.com/lists/oss-security/2011/09/30/5).
- collector/nvd-historical
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/severity
- agent/references
- agent/last-modified-date
- agent/weakness
- agent/tags
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-3585
- vendor/samba
- canonical/samba samba
- version/samba samba/3.6.0
- vendor/redhat
- canonical/redhat enterprise linux
- version/redhat enterprise linux/4.0
- version/redhat enterprise linux/6.0
- version/redhat enterprise linux/5.0