mount and umount in util-linux and loop-aes-utils call the setuid and setgid functions in the wrong order and do not check the return values, which might allow attackers to gain privileges via helpers such as mount.nfs.

From Red Hat Security Advisory 2007:0969 :

Updated util-linux packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The util-linux package contains a large variety of low-level system utilities that are necessary for a Linux system to function.

A flaw was discovered in the way that the mount and umount utilities used the setuid and setgid functions, which could lead to privileges being dropped improperly. A local user could use this flaw to run mount helper applications such as, mount.nfs, with additional privileges (CVE-2007-5191).

Users are advised to update to these erratum packages which contain a backported patch to correct this issue.

A flaw was discovered in the way that the mount and umount utilities used the setuid and setgid functions, which could lead to privileges being dropped improperly. A local user could use this flaw to run mount helper applications such as, mount.nfs, with additional privileges (CVE-2007-5191)

I   Service Console package security updates

  a. OpenPegasus PAM Authentication Buffer Overflow

  Alexander Sotirov from VMware Security Research discovered a   buffer overflow vulnerability in the OpenPegasus Management server.
  This flaw could be exploited by a malicious remote user on the   service console network to gain root access to the service console.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the name CVE-2007-5360 to this issue.

  b.   Updated Samba package

       An issue where attackers on the service console management        network can cause a stack-based buffer overflow in the        reply_netbios_packet function of nmbd in Samba. On systems        where Samba is being used as a WINS server, exploiting this        vulnerability can allow remote attackers to execute arbitrary        code via crafted WINS Name Registration requests followed by a        WINS Name Query request.

       An issue where attackers on the service console management        network can exploit a vulnerability that occurs when Samba is        configured as a Primary or Backup Domain controller. The        vulnerability allows remote attackers to have an unknown impact        via crafted GETDC mailslot requests, related to handling of        GETDC logon server requests.

       The Common Vulnerabilities and Exposures project (cve.mitre.org)        has assigned the names CVE-2007-5398 and CVE-2007-4572 to these        issues.

 Note: By default Samba is not configured as a WINS server or a domain        controller and ESX is not vulnerable unless the administrator        has changed the default configuration.

       This vulnerability can be exploited remotely only if the        attacker has access to the service console network.

       Security best practices provided by VMware recommend that the        service console be isolated from the VM network. Please see        http://www.vmware.com/resources/techresources/726 for more        information on VMware security best practices.

  c.   Updated util-linux package

       The patch addresses an issue where the mount and umount        utilities in util-linux call the setuid and setgid functions in        the wrong order and do not check the return values, which could        allow attackers to gain elevated privileges via helper        application such as mount.nfs.

       The Common Vulnerabilities and Exposures project (cve.mitre.org)        has assigned the name CVE-2007-5191 to this issue.

  d.   Updated Perl package

       The update addresses an issue where the regular expression        engine in Perl can be used to issue a specially crafted regular        expression that allows the attacker to run arbitrary code with        the permissions level of the current Perl user.

       The Common Vulnerabilities and Exposures project (cve.mitre.org)        has assigned the name CVE-2007-5116 to this issue.

  e.   Updated OpenSSL package

       A flaw in the SSL_get_shared_ciphers() function could allow an        attacker to cause a buffer overflow problem by sending ciphers        to applications that use the function.

       The Common Vulnerabilities and Exposures project (cve.mitre.org)        has assigned the names CVE-2007-3108, and CVE-2007-5135 to these        issues.

Updated util-linux packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The util-linux package contains a large variety of low-level system utilities that are necessary for a Linux system to function.

A flaw was discovered in the way that the mount and umount utilities used the setuid and setgid functions, which could lead to privileges being dropped improperly. A local user could use this flaw to run mount helper applications such as, mount.nfs, with additional privileges (CVE-2007-5191).

Users are advised to update to these erratum packages which contain a backported patch to correct this issue.

It was discovered that util-linux, miscellaneous system utilities, didn't drop privileged user and group permissions in the correct order in the mount and umount commands. This could potentially allow a local user to gain additional privileges.

It was discovered that loop-aes-utils, tools for mounting and manipulating filesystems, didn't drop privileged user and group permissions in the correct order in the mount and umount commands.
This could potentially allow a local user to gain additional privileges.

Ludwig Nussel discovered that mount and umount did not properly drop privileges when using helper programs. Local attackers may be able to bypass security restrictions and gain root privileges using programs such as mount.nfs or mount.cifs.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Mon Oct 8 2007 Karel Zak <kzak at redhat.com>     2.13-0.54.1

    - fix #320131 - CVE-2007-5191 util-linux (u)mount       doesn't drop privileges properly when calling helpers       [F7]

    - Wed Aug 8 2007 Karel Zak <kzak at redhat.com>       2.13-0.54

    - backport mount relatime patch

    - Thu Aug 2 2007 Karel Zak <kzak at redhat.com>       2.13-0.53

    - fix #236848 - mount/fstab.c:lock_mtab() should open       with proper permissions

    - fix #238918 - blockdev --getsize does not work       properly on devices with more than 2^31 sectors

    - Mon Jul 9 2007 Karel Zak <kzak at redhat.com>       2.13-0.52

    - fix #245578 - login's PAM configuration inits the       keyring at an inconvenient time

    - fix #231532 - 'pamconsole' not documented in mount(8)

    - fix #243930 - translation files exist, but are not       being used

    - fix #228731 - sfdisk doesn't support DM-MP device (add       default heads and sectors)

    - fix #231192 - ipcs is not printing correct values on       pLinux

    - fix #245912 - mount doesn't write the 'loop=...'       option in /etc/mtab when mounting a loop device

    - fix #213253 - 'cal -3' generates improperly formatted       output

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200710-18 (util-linux: Local privilege escalation)

    Ludwig Nussel discovered that the check_special_mountprog() and     check_special_umountprog() functions call setuid() and setgid() in the     wrong order and do not check the return values, which can lead to     privileges being dropped improperly.
  Impact :

    A local attacker may be able to exploit this vulnerability by using     mount helpers such as the mount.nfs program to gain root privileges and     run arbitrary commands.
  Workaround :

    There is no known workaround at this time.

Insufficient length checks when reading the passphrase for encrypted paritions in the mount program could cause a buffer overflow that could potentially be exploited to gain root privileges.

When executing helper program 'mount' didn't check the return value of setuid(). Therefore helper program could potenially run as root (CVE-2007-5191).

The mount and umount programs in util-linux called the setuid() and setgid() functions in the wrong order and did not check the return values, which could allow attackers to grain privileges via helper applications such as mount.nfs.

Updated packages have been patched to fix this issue.

ID	Name	Product	Family	Severity
67589	Oracle Linux 3 / 4 : util-linux (ELSA-2007-0969)	Nessus	Oracle Linux Local Security Checks	medium
60311	Scientific Linux Security Update : util-linux on SL5.x, SL4.x, SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
40372	VMSA-2008-0001 : Moderate OpenPegasus PAM Authentication Buffer Overflow and updated service console packages	Nessus	VMware ESX Local Security Checks	high
36400	CentOS 3 / 4 : util-linux (CESA-2007:0969)	Nessus	CentOS Local Security Checks	medium
29859	Debian DSA-1450-1 : util-linux - programming error	Nessus	Debian Local Security Checks	medium
29858	Debian DSA-1449-1 : loop-aes-utils - programming error	Nessus	Debian Local Security Checks	medium
28242	RHEL 3 / 4 / 5 : util-linux (RHSA-2007:0969)	Nessus	Red Hat Local Security Checks	medium
28139	Ubuntu 6.06 LTS / 6.10 / 7.04 : util-linux vulnerability (USN-533-1)	Nessus	Ubuntu Local Security Checks	medium
27773	Fedora 7 : util-linux-2.13-0.54.1.fc7 (2007-2462)	Nessus	Fedora Local Security Checks	medium
27516	GLSA-200710-18 : util-linux: Local privilege escalation	Nessus	Gentoo Local Security Checks	medium
27514	openSUSE 10 Security Update : util-linux (util-linux-4552)	Nessus	SuSE Local Security Checks	medium
27071	Mandrake Linux Security Advisory : util-linux (MDKSA-2007:198)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2007-5191

critical

Tenable Plugins

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium