The Fuse Social Floating Sidebar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the file upload functionality in all versions up to, and including, 5.4.10 due to insufficient validation of SVG files. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Multiple stored cross-site scripting (XSS) flaws were found in the Fuse Management Console. A remote attacker could use this flaw to perform an XSS attack against other users of the Fuse Management Console.

fuse 2.8.5 and earlier does not properly handle when /etc/mtab cannot be updated, which allows local users to unmount arbitrary directories via a symlink attack.

Certain legacy functionality in fusermount in fuse 2.8.5 and earlier, when util-linux does not support the --no-canonicalize option, allows local users to bypass intended access restrictions and unmount arbitrary directories via a symlink attack.

fusermount in fuse 2.8.5 and earlier does not perform a chdir to / before performing a mount or umount, which allows local users to unmount arbitrary directories via unspecified vectors.

fusermount in FUSE before 2.7.5, and 2.8.x before 2.8.2, allows local users to unmount an arbitrary FUSE filesystem share via a symlink attack on a mountpoint.

FUSE 2.x before 2.3.0 does not properly clear previously used memory from unfilled pages when the filesystem returns a short byte count to a read request, which may allow local users to obtain sensitive information.

Several race condition flaws were found in samba-client, fuse and ncpfs packages:

a, Ronald Volgers found a race condition in the samba-client's mount.cifs utility. Local, unprivileged user could use this flaw to conduct symlink attacks, leading to disclosure of sensitive information, or, possibly to privilege escalation.

Upstream bug report: https://bugzilla.samba.org/showbug.cgi?id=6853

Upstream Samba patches: http://git.samba.org/?p=samba.git;a=commit;h=3ae5dac462c4ed0fb2cd94553583c56fce2f9d80 http://git.samba.org/?p=samba.git;a=commit;h=a065c177dfc8f968775593ba00dffafeebb2e054 http://git.samba.org/?p=samba.git;a=commit;h=a0c31ec1c8d1220a5884e40d9ba6b191a04a24d5

Issue severity note for Red Hat Enteprise Linux: ------------------------------------------------

The mount.cifs binary, as shipped within samba-client package on Red Hat Enterprise Linux 4 and 5, is NOT shipped with setuid root bit enabled by default (local, unprivileged users on these systems are NOT able to mount custom CIFS filesystem shares), which mitigates the impact of the vulnera- bility.

b, Dan Rosenberg found a race condition in the FUSE's fusermount's utility by performing FUSE filesystem(s) unmount operation (it was not performed atomically). A local, unprivileged user could use this flaw to cause a denial of service (unprivileged unmount of FUSE filesystem share(s) owned by privileged user) via symlink attack involving FUSE share(s) belonging to privileged user.

Issue severity note for Red Hat Enterprise Linux: -------------------------------------------------

The "fusermount" utility, as shipped within "fuse" package in Red Hat Enterprise Linux 5 IS shipped with setuid root bit enabled by default, but the unprivileged user to be able to mount custom FUSE filesystem, he needs prior to be the member of special "fuse" users group (user membership in this group is granted by privileged user), which mitigates the impact of the vulnerability.

c, Dan Rosenberg found race conditions in the ncpfs ncpmount and ncpumount utilities. Local, unprivileged user could use these flaws to conduct symlink attacks, leading to denial of service (ncpumount), disclosure of sensitive information, or, possibly to privilege escalation (ncpmount).

Issue severity note for Fedora: -------------------------------

The "ncpmount and ncpumount" utilities, as shipped within "ncpfs" package in Fedora release of 11 and 12 are NOT shipped with setuid root bit enabled by default (unprivileged, local users are NOT able to mount / umount custom remote NCP shares), which mitigates the impact of the flaws.

Acknowledgements:

Red Hat would like to thank Dan Rosenberg for responsibly reporting these flaws.

Dan Rosenberg reported a flaw with suid mount helpers handle access to /etc/mtab [1], which could allow an unprivileged user to corrupt /etc/mtab and possibly manipulate mountpoint options or unmount a filesystem.

The original report follows.

This was originally sent to the now-defunct vendor-sec mailing list. Seeing how it's a relatively low-severity issue and that we're currently lacking a mechanism for coordination among package maintainers and vendors, this list seems like a perfectly acceptable venue for discussing how to fix it.

I discovered that essentially every suid mount helper that uses addmntent() (or invokes util-linux mount, which in turn calls addmntent()) to add entries to /etc/mtab fails to anticipate a low value for RLIMITFSIZE, allowing unprivileged users to corrupt /etc/mtab and possibly manipulate mountpoint options. Affected software includes at least:

mount.cifs (samba) fusermount (FUSE) mount (util-linux) ncpmount (ncpfs) vmware-hgfsmounter (open-vm-tools)

Also affected are all their unmount equivalents.

This can be exploited by checking the current size of /etc/mtab, setting an RLIMITFSIZE of some small amount greater than that, and invoking a suid mount helper. The edits to /etc/mtab will be truncated to the ulimit and no newline will be appended, so multiple invocations allow near-arbitrary appending to /etc/mtab. addmntent() will octal-encode most special characters, which makes exploitation beyond simple corruption not quite as straightforward, but I'm confident that with some creativity it would be possible to perform unauthorized unmounting, for example.

There are a few possible options We could patch glibc to try to raise the rlimit in addmntent(). Or we could fix every suid mount helper to raise the rlimit or have proper error handling for the case when addmntent() fails. This final option requires that mtab editing be done in a temporary file and aborted on failure, which isn't the case for all helpers.

Of course, once we figure out how to fix this, we can talk about assigning CVEs, etc.

And a followup regarding specific mount helpers:

I did a survey of some suid helpers I'm aware of. Here's the existing behavior:

util-linux mount ============= Edits /etc/mtab.tmp with custom myaddmntent(), behaves identically to glibc addmntent() in terms of return code Succeeds on partial writes, does not remove temp file on failure (could result in additional corruption of /etc/mtab through multiple invocations), does not remove lock file /etc/mtab~ on failure (also an issue)

fusermount (FUSE) ================ Does not edit mtab directly, calls into util-linux mount/umount, no changes needed

mount.cifs (samba) ================ mount.cifs edits /etc/mtab directly, no cleanup on addmntent() failure umount.cifs edits /etc/mtab.tmp but does not check return code of addmntent()

ncpmount (ncpfs) ============== ncpmount edits /etc/mtab directly, no cleanup on failure, does not remove lock file /etc/mtab~ on failure ncpumount edits /etc/mtab.tmp but does not check return code of addmntent()

vmware-hgfsmounter (open-vm-tools) =============================== edits /etc/mtab directly, no cleanup on failure

Further discussion is ongoing via the oss-security mailing list.

[1] http://thread.gmane.org/gmane.comp.security.oss.general/4374

+++ This bug was initially created as a clone of Bug #532940 +++

Several race condition flaws were found in samba-client, fuse and ncpfs packages:

a, Ronald Volgers found a race condition in the samba-client's mount.cifs utility. Local, unprivileged user could use this flaw to conduct symlink attacks, leading to disclosure of sensitive information, or, possibly to privilege escalation.

Upstream bug report: https://bugzilla.samba.org/showbug.cgi?id=6853

Upstream Samba patches: http://git.samba.org/?p=samba.git;a=commit;h=3ae5dac462c4ed0fb2cd94553583c56fce2f9d80 http://git.samba.org/?p=samba.git;a=commit;h=a065c177dfc8f968775593ba00dffafeebb2e054 http://git.samba.org/?p=samba.git;a=commit;h=a0c31ec1c8d1220a5884e40d9ba6b191a04a24d5

Issue severity note for Red Hat Enteprise Linux: ------------------------------------------------

The mount.cifs binary, as shipped within samba-client package on Red Hat Enterprise Linux 4 and 5, is NOT shipped with setuid root bit enabled by default (local, unprivileged users on these systems are NOT able to mount custom CIFS filesystem shares), which mitigates the impact of the vulnera- bility.

b, Dan Rosenberg found a race condition in the FUSE's fusermount's utility by performing FUSE filesystem(s) unmount operation (it was not performed atomically). A local, unprivileged user could use this flaw to cause a denial of service (unprivileged unmount of FUSE filesystem share(s) owned by privileged user) via symlink attack involving FUSE share(s) belonging to privileged user.

Issue severity note for Red Hat Enterprise Linux: -------------------------------------------------

The "fusermount" utility, as shipped within "fuse" package in Red Hat Enterprise Linux 5 IS shipped with setuid root bit enabled by default, but the unprivileged user to be able to mount custom FUSE filesystem, he needs prior to be the member of special "fuse" users group (user membership in this group is granted by privileged user), which mitigates the impact of the vulnerability.

c, Dan Rosenberg found race conditions in the ncpfs ncpmount and ncpumount utilities. Local, unprivileged user could use these flaws to conduct symlink attacks, leading to denial of service (ncpumount), disclosure of sensitive information, or, possibly to privilege escalation (ncpmount).

Issue severity note for Fedora: -------------------------------

The "ncpmount and ncpumount" utilities, as shipped within "ncpfs" package in Fedora release of 11 and 12 are NOT shipped with setuid root bit enabled by default (unprivileged, local users are NOT able to mount / umount custom remote NCP shares), which mitigates the impact of the flaws.

MITRE has rejected the use of CVE-2009-3297 because it was used for samba, ncpfs, and fuse when it should only have been used for Samba.

Instead, new CVEs have been assigned as follows:

CVE-2010-0787: samba CVE-2010-0788: ncpfs CVE-2010-0789: fuse

This issue does not affect Red Hat Enterprise Linux 4 and 5 by default as mount.cifs is not provided with the setuid bit enabled. If a user has turned on the setuid bit (via 'chmod +s /sbin/mount.cifs'), they would be affected by this issue and can workaround the problem by removing the setuid bit.

Red Hat Enterprise Linux 3 does not provide the mount.cifs program.

The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here:

http://www.redhat.com/security/updates/classification/

Fuse ESB Enterprise is an integration platform based on Apache ServiceMix.Fuse MQ Enterprise, based on Apache ActiveMQ, is a standards-compliantmessaging system that is tailored for use in mission critical applications.Fuse ESB Enterprise and Fuse MQ Enterprise include the insight plug-in,which provides insight into a Fuse Fabric using Elasticsearch to query datafor logs, metrics or historic Camel messages. This plug-in is not enabledby default, and is provided as a technology preview. If it is enabled byinstalling the feature, for example:JBossFuse:karaf@root> features:install insight-elasticsearchThen an Elasticsearch server will be started. It was discovered that thedefault configuration of Elasticsearch enabled dynamic scripting, allowinga remote attacker to execute arbitrary MVEL expressions and Java code viathe source parameter passed to search. (CVE-2014-3120)All users of Fuse ESB Enterprise and Fuse MQ Enterprise 7.1.0 as providedfrom the Red Hat Customer Portal who have enabled Elasticsearch are advisedto follow the instructions provided in the Solution section of thisadvisory.

Fuse ESB Enterprise, based on Apache ServiceMix, provides an integrationplatform.This release of Fuse ESB Enterprise 7.1.0 roll up patch 1 is an update toFuse ESB Enterprise 7.1.0 and includes bug fixes. Refer to the readme fileincluded with the patch files for information about the bug fixes.The following security issues are also fixed with this release:XML encryption backwards compatibility attacks were found against variousframeworks, including Apache CXF. An attacker could force a server to useinsecure, legacy cryptosystems, even when secure cryptosystems were enabledon endpoints. By forcing the use of legacy cryptosystems, flaws such asCVE-2011-1096 and CVE-2011-2487 would be exposed, allowing plain text to berecovered from cryptograms and symmetric keys. (CVE-2012-5575)Note: Automatic checks to prevent CVE-2012-5575 are only run whenWS-SecurityPolicy is used to enforce security requirements. It is bestpractice to use WS-SecurityPolicy to enforce security requirements.A flaw in JRuby's JSON gem allowed remote attacks by creating differenttypes of malicious objects. For example, it could initiate a denial ofservice attack through resource consumption by using a JSON document tocreate arbitrary Ruby symbols, which were never garbage collected. It couldalso be exploited to create internal objects which could allow a SQLinjection attack. (CVE-2013-0269)It was discovered that JRuby's REXML library did not properly restrict XMLentity expansion. An attacker could use this flaw to cause a denial ofservice by tricking a Ruby application using REXML to read text nodes fromspecially-crafted XML content, which will result in REXML consuming largeamounts of system memory. (CVE-2013-1821)Multiple denial of service flaws were found in the way the Apache CXFStAX parser implementation processed certain XML files. If a web serviceutilized the StAX parser, a remote attacker could provide aspecially-crafted XML file that, when processed, would lead to excessiveCPU and memory consumption. (CVE-2013-2160)Note: Fuse ESB Enterprise 7.1.0 ships JRuby as part of the camel-rubycomponent, which allows users to define Camel routes in Ruby. The defaultuse of JRuby in Fuse ESB Enterprise 7.1.0 does not appear to expose eitherCVE-2013-0269 or CVE-2013-1821. If the version of JRuby shipped with FuseESB Enterprise 7.1.0 was used to build a custom application, then theseflaws could be exposed.Red Hat would like to thank Tibor Jager, Kenneth G. Paterson and JurajSomorovsky of Ruhr-University Bochum for reporting CVE-2012-5575; Rubyon Rails upstream for reporting CVE-2013-0269; and Andreas Falkenberg ofSEC Consult Deutschland GmbH, and Christian Mainka, Juraj Somorovsky andJoerg Schwenk of Ruhr-University Bochum for reporting CVE-2013-2160.Upstream acknowledges Thomas Hollstegge of Zweitag and Ben Murphy as theoriginal reporters of CVE-2013-0269.All users of Fuse ESB Enterprise 7.1.0 as provided from the Red HatCustomer Portal are advised to upgrade to Fuse ESB Enterprise 7.1.0 roll uppatch 1.

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2010-0787, CVE-2010-0788, CVE-2010-0789. Reason: this candidate was intended for one issue in Samba, but it was used for multiple distinct issues, including one in FUSE and one in ncpfs. Notes: All CVE users should consult CVE-2010-0787 (Samba), CVE-2010-0788 (ncpfs), and CVE-2010-0789 (FUSE) to determine which ID is appropriate. All references and descriptions in this candidate have been removed to prevent accidental usage.