client/mount.cifs.c in mount.cifs in smbfs in Samba 3.0.22, 3.0.28a, 3.2.3, 3.3.2, 3.4.0, and 3.4.5 allows local users to mount a CIFS share on an arbitrary mountpoint, and gain privileges, via a symlink attack on the mountpoint directory file.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party libraries :

  - COS kernel
  - cURL
  - python
  - rpm

From Red Hat Security Advisory 2011:1219 :

Updated samba packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Samba is a suite of programs used by machines to share files, printers, and other information.

A cross-site scripting (XSS) flaw was found in the password change page of the Samba Web Administration Tool (SWAT). If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially crafted URL, it would lead to arbitrary web script execution in the context of the user's SWAT session.
(CVE-2011-2694)

It was found that SWAT web pages did not protect against Cross-Site Request Forgery (CSRF) attacks. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially crafted URL, the attacker could perform Samba configuration changes with the privileges of the logged in user. (CVE-2011-2522)

A race condition flaw was found in the way the mount.cifs tool mounted CIFS (Common Internet File System) shares. If mount.cifs had the setuid bit set, a local attacker could conduct a symbolic link attack to trick mount.cifs into mounting a share over an arbitrary directory they were otherwise not allowed to mount to, possibly allowing them to escalate their privileges. (CVE-2010-0787)

It was found that the mount.cifs tool did not properly handle share or directory names containing a newline character. If mount.cifs had the setuid bit set, a local attacker could corrupt the mtab (mounted file systems table) file via a specially crafted CIFS share mount request.
(CVE-2010-0547)

It was found that the mount.cifs tool did not handle certain errors correctly when updating the mtab file. If mount.cifs had the setuid bit set, a local attacker could corrupt the mtab file by setting a small file size limit before running mount.cifs. (CVE-2011-1678)

Note: mount.cifs from the samba packages distributed by Red Hat does not have the setuid bit set. We recommend that administrators do not manually set the setuid bit for mount.cifs.

Red Hat would like to thank the Samba project for reporting CVE-2011-2694 and CVE-2011-2522; the Debian Security Team for reporting CVE-2010-0787; and Dan Rosenberg for reporting CVE-2011-1678. Upstream acknowledges Nobuhiro Tsuji of NTT DATA Security Corporation as the original reporter of CVE-2011-2694;
Yoshihiro Ishikawa of LAC Co., Ltd. as the original reporter of CVE-2011-2522; and the Debian Security Team acknowledges Ronald Volgers as the original reporter of CVE-2010-0787.

Users of Samba are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. After installing this update, the smb service will be restarted automatically.

Samba is a suite of programs used by machines to share files, printers, and other information.

A cross-site scripting (XSS) flaw was found in the password change page of the Samba Web Administration Tool (SWAT). If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially crafted URL, it would lead to arbitrary web script execution in the context of the user's SWAT session.
(CVE-2011-2694)

It was found that SWAT web pages did not protect against Cross-Site Request Forgery (CSRF) attacks. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially crafted URL, the attacker could perform Samba configuration changes with the privileges of the logged in user. (CVE-2011-2522)

A race condition flaw was found in the way the mount.cifs tool mounted CIFS (Common Internet File System) shares. If mount.cifs had the setuid bit set, a local attacker could conduct a symbolic link attack to trick mount.cifs into mounting a share over an arbitrary directory they were otherwise not allowed to mount to, possibly allowing them to escalate their privileges. (CVE-2010-0787)

It was found that the mount.cifs tool did not properly handle share or directory names containing a newline character. If mount.cifs had the setuid bit set, a local attacker could corrupt the mtab (mounted file systems table) file via a specially crafted CIFS share mount request.
(CVE-2010-0547)

It was found that the mount.cifs tool did not handle certain errors correctly when updating the mtab file. If mount.cifs had the setuid bit set, a local attacker could corrupt the mtab file by setting a small file size limit before running mount.cifs. (CVE-2011-1678)

Note: mount.cifs from the samba packages distributed by Red Hat does not have the setuid bit set. We recommend that administrators do not manually set the setuid bit for mount.cifs.

Users of Samba are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. After installing this update, the smb service will be restarted automatically.

The remote host is affected by the vulnerability described in GLSA-201206-29 (mount-cifs: Multiple vulnerabilites)

    Multiple vulnerabilities have been discovered in mount-cifs. Please       review the CVE identifiers referenced below for details.
  Impact :

    The vulnerabilities allow local users to cause a denial of service (mtab       corruption) via a crafted string. Also, local users could mount a CIFS       share on an arbitrary mountpoint, and gain privileges via a symlink       attack on the mountpoint directory file.
  Workaround :

    There is no known workaround at this time.

a. ESX third-party update for Service Console kernel      The ESX Service Console Operating System (COS) kernel is updated to    kernel-2.6.18-274.3.1.el5 to fix multiple security issues in the    COS kernel.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2011-0726, CVE-2011-1078, CVE-2011-1079,    CVE-2011-1080, CVE-2011-1093, CVE-2011-1163, CVE-2011-1166,    CVE-2011-1170, CVE-2011-1171, CVE-2011-1172, CVE-2011-1494,    CVE-2011-1495, CVE-2011-1577, CVE-2011-1763, CVE-2010-4649,    CVE-2011-0695, CVE-2011-0711, CVE-2011-1044, CVE-2011-1182,    CVE-2011-1573, CVE-2011-1576, CVE-2011-1593, CVE-2011-1745,    CVE-2011-1746, CVE-2011-1776, CVE-2011-1936, CVE-2011-2022,    CVE-2011-2213, CVE-2011-2492, CVE-2011-1780, CVE-2011-2525,    CVE-2011-2689, CVE-2011-2482, CVE-2011-2491, CVE-2011-2495,    CVE-2011-2517, CVE-2011-2519, CVE-2011-2901 to these issues.
  b. ESX third-party update for Service Console cURL RPM      The ESX Service Console (COS) curl RPM is updated to cURL-7.15.5.9    resolving a security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the name CVE-2011-2192 to this issue.
  c. ESX third-party update for Service Console nspr and nss RPMs      The ESX Service Console (COS) nspr and nss RPMs are updated to    nspr-4.8.8-1.el5_7 and nss-3.12.10-4.el5_7 respectively resolving    a security issues.
     A Certificate Authority (CA) issued fraudulent SSL certificates and    Netscape Portable Runtime (NSPR) and Network Security Services (NSS)    contain the built-in tokens of this fraudulent Certificate    Authority. This update renders all SSL certificates signed by the    fraudulent CA as untrusted for all uses.
  d. ESX third-party update for Service Console rpm RPMs      The ESX Service Console Operating System (COS) rpm packages are    updated to popt-1.10.2.3-22.el5_7.2, rpm-4.4.2.3-22.el5_7.2,    rpm-libs-4.4.2.3-22.el5_7.2 and rpm-python-4.4.2.3-22.el5_7.2    which fixes multiple security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2010-2059 and CVE-2011-3378 to these    issues.
  e. ESX third-party update for Service Console samba RPMs      The ESX Service Console Operating System (COS) samba packages are    updated to samba-client-3.0.33-3.29.el5_7.4,    samba-common-3.0.33-3.29.el5_7.4 and    libsmbclient-3.0.33-3.29.el5_7.4 which fixes multiple security    issues in the Samba client.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2010-0547, CVE-2010-0787, CVE-2011-1678,    CVE-2011-2522 and CVE-2011-2694 to these issues.
     Note that ESX does not include the Samba Web Administration Tool    (SWAT) and therefore ESX COS is not affected by CVE-2011-2522 and    CVE-2011-2694.
  f. ESX third-party update for Service Console python package      The ESX Service Console (COS) python package is updated to    2.4.3-44 which fixes multiple security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2009-3720, CVE-2010-3493, CVE-2011-1015 and    CVE-2011-1521 to these issues.
  g. ESXi update to third-party component python      The python third-party library is updated to python 2.5.6 which    fixes multiple security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2009-3560, CVE-2009-3720, CVE-2010-1634,    CVE-2010-2089, and CVE-2011-1521 to these issues.

Updated samba packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Samba is a suite of programs used by machines to share files, printers, and other information.

A cross-site scripting (XSS) flaw was found in the password change page of the Samba Web Administration Tool (SWAT). If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially crafted URL, it would lead to arbitrary web script execution in the context of the user's SWAT session.
(CVE-2011-2694)

It was found that SWAT web pages did not protect against Cross-Site Request Forgery (CSRF) attacks. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially crafted URL, the attacker could perform Samba configuration changes with the privileges of the logged in user. (CVE-2011-2522)

A race condition flaw was found in the way the mount.cifs tool mounted CIFS (Common Internet File System) shares. If mount.cifs had the setuid bit set, a local attacker could conduct a symbolic link attack to trick mount.cifs into mounting a share over an arbitrary directory they were otherwise not allowed to mount to, possibly allowing them to escalate their privileges. (CVE-2010-0787)

It was found that the mount.cifs tool did not properly handle share or directory names containing a newline character. If mount.cifs had the setuid bit set, a local attacker could corrupt the mtab (mounted file systems table) file via a specially crafted CIFS share mount request.
(CVE-2010-0547)

It was found that the mount.cifs tool did not handle certain errors correctly when updating the mtab file. If mount.cifs had the setuid bit set, a local attacker could corrupt the mtab file by setting a small file size limit before running mount.cifs. (CVE-2011-1678)

Note: mount.cifs from the samba packages distributed by Red Hat does not have the setuid bit set. We recommend that administrators do not manually set the setuid bit for mount.cifs.

Red Hat would like to thank the Samba project for reporting CVE-2011-2694 and CVE-2011-2522; the Debian Security Team for reporting CVE-2010-0787; and Dan Rosenberg for reporting CVE-2011-1678. Upstream acknowledges Nobuhiro Tsuji of NTT DATA Security Corporation as the original reporter of CVE-2011-2694;
Yoshihiro Ishikawa of LAC Co., Ltd. as the original reporter of CVE-2011-2522; and the Debian Security Team acknowledges Ronald Volgers as the original reporter of CVE-2010-0787.

Users of Samba are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. After installing this update, the smb service will be restarted automatically.

This update of the Samba server package fixes the following security issues :

  - A buffer overrun was possible in chain_reply code in     3.3.x and below, which could be used to crash the samba     server or potentially execute code. (CVE-2010-2063)

  - Take extra care that a mount point of mount.cifs does     not get changed during mount. (CVE-2010-0787)

Also, the following bugs have been fixed :

  - Honor interface list in net ads dns register.
    (bnc#606947)

  - An uninitialized variable read could cause smbd to crash     (bso#7254, bnc#605935).

- Thu Sep 9 2010 Guenther Deschner <gdeschner at     redhat.com> - 3.4.9-60

    - Security Release, fixes CVE-2010-3069

    - resolves: #630869

    - Wed May 12 2010 Guenther Deschner <gdeschner at       redhat.com> - 3.4.8-59

    - Update to 3.4.8

    - Make sure nmb and smb initscripts return LSB compliant       return codes

    - resolves: #521095

    - Mon Mar 8 2010 Simo Sorce <ssorce at redhat.com> -       3.4.7-58

    - Security update to 3.4.7

    - Fixes CVE-2010-0728

    - Wed Feb 24 2010 Guenther Deschner <gdeschner at       redhat.com> - 3.4.6-57

    - Update to 3.4.6

    - Wed Feb 17 2010 Guenther Deschner <gdeschner at       redhat.com> - 3.4.5-56

    - Fix crash in cifs.upcall

    - resolves: #565446

    - Tue Jan 26 2010 Guenther Deschner <gdeschner at       redhat.com> - 3.4.5-55

    - Security Release, fixes CVE-2009-3297

    - resolves: #532940

    - Tue Jan 26 2010 Guenther Deschner <gdeschner at       redhat.com> - 3.4.5-54

    - Fix crash in pdbedit

    - resolves: #541267

    - Tue Jan 19 2010 Guenther Deschner <gdeschner at       redhat.com> - 3.4.5-53

    - Update to 3.4.5

    - Thu Jan 14 2010 Guenther Deschner <gdeschner at       redhat.com> - 3.4.4-52

    - Fix crash bug in libsmbclient (SMBC_parse_path)

    - resolves: #552658

    - Thu Jan 7 2010 Guenther Deschner <gdeschner at       redhat.com> - 3.4.4-51

    - Update to 3.4.4

    - Tue Dec 1 2009 Guenther Deschner <gdeschner at       redhat.com> - 3.4.3-50

    - Fix uninitialized rpc client pipe, causing winbind to       crash

    - resolves: #541328

    - Wed Nov 25 2009 Guenther Deschner <gdeschner at       redhat.com> - 3.4.3-49

    - Various updates to inline documentation in default       smb.conf file

    - resolves: #483703

    - Thu Oct 29 2009 Guenther Deschner <gdeschner at       redhat.com> - 3.4.3-48

    - Update to 3.4.3

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of the Samba server package fixes security issues and bugs.

Following security issues were fixed: CVE-2010-2063: A buffer overrun was possible in chain_reply code in 3.3.x and below, which could be used to crash the samba server or potentially execute code.

CVE-2010-0787: Take extra care that a mount point of mount.cifs isn't changed during mount.

Also the following bugs were fixed :

  - Honor 'interfaces' list in net ad dns register.
    (bnc#606947)

  - An uninitialized variable read could cause an smbd     crash; (bso#7254); (bnc#605935).

CVE-2010-0728 * http://www.samba.org/samba/security/CVE-2010-0728

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Tue Jan 26 2010 Guenther Deschner <gdeschner at     redhat.com> - 3.4.5-55

    - Security Release, fixes CVE-2009-3297

    - resolves: #532940

    - Tue Jan 26 2010 Guenther Deschner <gdeschner at       redhat.com> - 3.4.5-54

    - Fix crash in pdbedit

    - resolves: #541267

    - Tue Jan 19 2010 Guenther Deschner <gdeschner at       redhat.com> - 3.4.5-53

    - Update to 3.4.5

    - Thu Jan 14 2010 Guenther Deschner <gdeschner at       redhat.com> - 3.4.4-52

    - Fix crash bug in libsmbclient (SMBC_parse_path)

    - resolves: #552658

    - Thu Jan 7 2010 Guenther Deschner <gdeschner at       redhat.com> - 3.4.4-51

    - Update to 3.4.4

    - Tue Dec 1 2009 Guenther Deschner <gdeschner at       redhat.com> - 3.4.3-50

    - Fix uninitialized rpc client pipe, causing winbind to       crash

    - resolves: #541328

    - Wed Nov 25 2009 Guenther Deschner <gdeschner at       redhat.com> - 3.4.3-49

    - Various updates to inline documentation in default       smb.conf file

    - resolves: #483703

    - Thu Oct 29 2009 Guenther Deschner <gdeschner at       redhat.com> - 3.4.3-48

    - Update to 3.4.3

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Tue Jan 26 2010 Guenther Deschner <gdeschner at     redhat.com> - 3.4.5-0.47

    - Security Release, fixes CVE-2009-3297

    - resolves: #532940

    - Tue Jan 19 2010 Guenther Deschner <gdeschner at       redhat.com> - 3.4.5-0.46

    - Update to 3.4.5

    - Thu Jan 7 2010 Guenther Deschner <gdeschner at       redhat.com> - 3.4.4-0.45

    - Update to 3.4.4

    - Thu Oct 29 2009 Guenther Deschner <gdeschner at       redhat.com> - 3.4.3-0.44

    - Update to 3.4.3

    - Wed Oct 7 2009 Guenther Deschner <gdeschner at       redhat.com> - 3.4.2-0.43

    - Fix required talloc version

    - resolves: #527806

    - Thu Oct 1 2009 Guenther Deschner <gdeschner at       redhat.com> - 3.4.2-0.42

    - Update to 3.4.2

    - Security Release, fixes CVE-2009-2813, CVE-2009-2948       and CVE-2009-2906

    - Wed Sep 9 2009 Guenther Deschner <gdeschner at       redhat.com> - 3.4.1.0-41

    - Update to 3.4.1

    - Fri Jul 17 2009 Guenther Deschner <gdeschner at       redhat.com> - 3.4.0-0.40

    - Fix Bug #6551 (vuid and tid not set in sessionsetupX       and tconX)

    - Specify required talloc and tdb version for       BuildRequires

    - Wed Jul 15 2009 Guenther Deschner <gdeschner at       redhat.com> - 3.4.0-0.39

    - Update to 3.4.0

    - resolves: #510558

    - Fri Jun 19 2009 Guenther Deschner <gdeschner at       redhat.com> - 3.3.5-0.38

    - Fix password expiry calculation in pam_winbind

    - Tue Jun 16 2009 Guenther Deschner <gdeschner at       redhat.com> - 3.3.5-0.37

    - Update to 3.3.5

    - Wed Apr 29 2009 Guenther Deschner <gdeschner at       redhat.com> - 3.3.4-0.36

    - Update to 3.3.4

    - Mon Apr 20 2009 Guenther Deschner <gdeschner at       redhat.com> - 3.3.3-0.35

    - Enable build of idmap_tdb2 for clustered setups

    - Wed Apr 1 2009 Guenther Deschner <gdeschner at       redhat.com> - 3.3.3-0.34

    - Update to 3.3.3

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilies has been found and corrected in samba :

client/mount.cifs.c in mount.cifs in smbfs in Samba does not verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which allows local users to cause a denial of service (mtab corruption) via a crafted string (CVE-2010-0547).

client/mount.cifs.c in mount.cifs in smbfs in Samba allows local users to mount a CIFS share on an arbitrary mountpoint, and gain privileges, via a symlink attack on the mountpoint directory file (CVE-2010-0787).

The updated packages have been patched to correct these issues.

Update :

It was discovered that the previous Samba update required libtalloc from Samba4 package. Therefore, this update provides the required packages in order to fix the issue.

Two local vulnerabilities have been discovered in samba, a SMB/CIFS file, print, and login server for Unix. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-3297     Ronald Volgers discovered that a race condition in     mount.cifs allows local users to mount remote     filesystems over arbitrary mount points.

  - CVE-2010-0547     Jeff Layton discovered that missing input sanitising in     mount.cifs allows denial of service by corrupting     /etc/mtab.

Ronald Volgers discovered that the mount.cifs utility, when installed as a setuid program, suffered from a race condition when verifying user permissions. A local attacker could trick samba into mounting over arbitrary locations, leading to a root privilege escalation.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
89105	VMware ESX / ESXi Service Console and Third-Party Libraries Multiple Vulnerabilities (VMSA-2012-0001) (remote check)	Nessus	Misc.	high
68335	Oracle Linux 4 / 5 : samba (ELSA-2011-1219)	Nessus	Oracle Linux Local Security Checks	medium
61123	Scientific Linux Security Update : samba on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
59702	GLSA-201206-29 : mount-cifs: Multiple vulnerabilites	Nessus	Gentoo Local Security Checks	medium
57749	VMSA-2012-0001 : VMware ESXi and ESX updates to third-party library and ESX Service Console	Nessus	VMware ESX Local Security Checks	high
55999	RHEL 4 / 5 : samba (RHSA-2011:1219)	Nessus	Red Hat Local Security Checks	medium
55997	CentOS 4 / 5 : samba (CESA-2011:1219)	Nessus	CentOS Local Security Checks	medium
50894	SuSE 11 Security Update : (SAT Patch Number 2544)	Nessus	SuSE Local Security Checks	high
49835	SuSE 10 Security Update : Samba (ZYPP Patch Number 7072)	Nessus	SuSE Local Security Checks	high
49248	Fedora 12 : samba-3.4.9-60.fc12 (2010-14678)	Nessus	Fedora Local Security Checks	high
47572	openSUSE Security Update : cifs-mount (openSUSE-SU-2010:0346-1)	Nessus	SuSE Local Security Checks	high
47570	openSUSE Security Update : cifs-mount (openSUSE-SU-2010:0346-1)	Nessus	SuSE Local Security Checks	high
47334	Fedora 11 : samba-3.4.7-0.50.fc11 (2010-4050)	Nessus	Fedora Local Security Checks	medium
47333	Fedora 12 : samba-3.4.7-58.fc12 (2010-3999)	Nessus	Fedora Local Security Checks	medium
47241	Fedora 12 : samba-3.4.5-55.fc12 (2010-1218)	Nessus	Fedora Local Security Checks	medium
47239	Fedora 11 : samba-3.4.5-0.47.fc11 (2010-1190)	Nessus	Fedora Local Security Checks	medium
46227	Mandriva Linux Security Advisory : samba (MDVSA-2010:090-1)	Nessus	Mandriva Local Security Checks	medium
44950	Debian DSA-2004-1 : samba - several vulnerabilities	Nessus	Debian Local Security Checks	medium
44336	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : samba vulnerability (USN-893-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2010-0787

critical

Tenable Plugins

high

medium

medium

medium

high

medium

medium

high

high

high

high

high

medium

medium

medium

medium

medium

medium

medium