REDHAT-BUG-742907: Race Condition
First published: Mon Oct 03 2011(Updated: )
A race condition was found in the way 'mount.cifs' and 'umount.cifs' utilities performed mount / umount of a particular CIFS share to / from specified mount point (/etc/mtab~ lockfile was created before updating the /etc/mtab file and deleted once the operation completed), when these utilies were setuid root enabled. A local attacker could use this flaw to conduct denial of service attacks (failure of subsequent CIFS share umount / mount requests) by sending termination signal to 'mount.cifs' / 'umount.cifs' processes in the moment of existence of a stale (/etc/mtab~) lockfile. References: [1] <a href="https://bugzilla.samba.org/show_bug.cgi?id=7179">https://bugzilla.samba.org/show_bug.cgi?id=7179</a> (upstream bug report) [2] <a href="http://git.samba.org/?p=cifs-utils.git;a=commitdiff;h=810f7e4e0f2dbcbee0294d9b371071cb08268200">http://git.samba.org/?p=cifs-utils.git;a=commitdiff;h=810f7e4e0f2dbcbee0294d9b371071cb08268200</a> (upstream patch) [3] <a href="http://www.openwall.com/lists/oss-security/2011/09/27/1">http://www.openwall.com/lists/oss-security/2011/09/27/1</a> (CVE request) [4] <a href="http://www.openwall.com/lists/oss-security/2011/09/30/5">http://www.openwall.com/lists/oss-security/2011/09/30/5</a> (CVE assignment) Note: This flaw to be exploitable as described above requires the 'mount.cifs' / 'umount.cifs' utilities to be setuid root enabled. These utilities are not setuid root enabled on Red Hat Enterprise Linux and Fedora distributions, and thus these distributions as such are not vulnerable to this flaw.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| CIFS Utils |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.samba.org/show_bug.cgi?id=7179
- http://git.samba.org/?p=cifs-utils.git;a=commitdiff;h=810f7e4e0f2dbcbee0294d9b371071cb08268200
- http://www.openwall.com/lists/oss-security/2011/09/27/1
- http://www.openwall.com/lists/oss-security/2011/09/30/5
- https://rhn.redhat.com/errata/RHSA-2011-1219.html
- https://rhn.redhat.com/errata/RHSA-2011-1221.html
- https://bugzilla.redhat.com/show_bug.cgi?id=742907
Frequently Asked Questions
What is the severity of REDHAT-BUG-742907?
The severity of REDHAT-BUG-742907 is classified as medium due to the race condition vulnerability that can lead to potential information disclosure.
How do I fix REDHAT-BUG-742907?
To fix REDHAT-BUG-742907, ensure you update the Samba cifs-utils to the latest version that addresses this race condition.
Which systems are affected by REDHAT-BUG-742907?
Systems using Samba cifs-utils for mounting CIFS shares are affected by REDHAT-BUG-742907.
What are the risks associated with REDHAT-BUG-742907?
The risks associated with REDHAT-BUG-742907 include potential unauthorized access to filesystem information during simultaneous mount operations.
Is there a workaround for REDHAT-BUG-742907?
A workaround for REDHAT-BUG-742907 is to avoid simultaneous executions of mount.cifs and umount.cifs commands on the same CIFS share.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-3585
- agent/severity
- agent/references
- agent/weakness
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/samba
- canonical/cifs utils