REDHAT-BUG-726691

First published: Fri Jul 29 2011(Updated: )

Originally the <a href="https://access.redhat.com/security/cve/CVE-2010-0547">CVE-2010-0547</a> identifier has been assigned by Common Vulnerabilities and Exposures to the following security issue: client/mount.cifs.c in mount.cifs in smbfs in Samba 3.4.5 and earlier does not verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which allows local users to cause a denial of service (mtab corruption) via a crafted string. Later a bug was found in the upstream patch for this issue. More specifically: check_mtab() calls check_newline() to check device and directory name. check_newline() returns EX_USAGE (1) when error is detected, while check_mtab() expects -1 to indicate an error. This bug in original <a href="https://access.redhat.com/security/cve/CVE-2010-0547">CVE-2010-0547</a> fix (not to propagate the error properly) caused mount.cifs command on specially-crafted mount point (containing newline character) still to succeed and potentially, to corrupt mtab table on the systems, where <a href="https://access.redhat.com/security/cve/CVE-2010-0296">CVE-2010-0296</a> glibc fix was not applied yet. Proposed upstream patch by Jeff Layton: [1] <a href="http://thread.gmane.org/gmane.linux.kernel.cifs/3827">http://thread.gmane.org/gmane.linux.kernel.cifs/3827</a>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/type
• agent/last-modified-date
• agent/first-publish-date
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2011-2724
• agent/severity
• agent/references
• agent/description
• agent/event
• agent/trending
• agent/source
• agent/softwarecombine
• agent/tags
• agent/guess-ai
• agent/software-canonical-lookup
• agent/software-canonical-lookup-request
• vendor/samba
• canonical/samba