sutil/ncpumount.c in ncpumount in ncpfs 2.2.6 produces certain detailed error messages about the results of privileged file-access attempts, which allows local users to determine the existence of arbitrary files via the mountpoint name.

This update fixes three security issues in ncpfs :

  - Fixed a information leakage on mount. (CVE-2010-0790 /     bnc#583536)

  - Fixed a mtab locking problem. (CVE-2010-0791 /     bnc#583536)

  - Fixed a race condition in ncpfs mounts (CVE-2010-0788 /     bnc#550004)

This update fixes three security issues in ncpfs :

Fixed a information leakage on mount (CVE-2010-0790 / bnc#583536) Fixed a mtab locking problem (CVE-2010-0791 / bnc#583536) Fixed a race condition in ncpfs mounts. (CVE-2010-0788 / bnc#550004)

This update fixes three security issues in ncpfs :

Fixed a information leakage on mount (CVE-2010-0790 / bnc#583536) Fixed a mtab locking problem (CVE-2010-0791 / bnc#583536) Fixed a race condition in ncpfs mounts (CVE-2010-0788 / bnc#550004)

Multiple vulnerabilities has been found and corrected in ncpfs :

sutil/ncpumount.c in ncpumount in ncpfs 2.2.6 produces certain detailed error messages about the results of privileged file-access attempts, which allows local users to determine the existence of arbitrary files via the mountpoint name (CVE-2010-0790).

The (1) ncpmount, (2) ncpumount, and (3) ncplogin programs in ncpfs 2.2.6 do not properly create lock files, which allows local users to cause a denial of service (application failure) via unspecified vectors that trigger the creation of a /etc/mtab~ file that persists after the program exits (CVE-2010-0791).

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers.

The updated packages have been patched to correct these issues.

ID	Name	Product	Family	Severity
50953	SuSE 11 / 11.1 Security Update : ncpfs (SAT Patch Numbers 2396 / 2456)	Nessus	SuSE Local Security Checks	medium
49904	SuSE 10 Security Update : ncpfs (ZYPP Patch Number 7023)	Nessus	SuSE Local Security Checks	medium
46671	openSUSE Security Update : ncpfs (openSUSE-SU-2010:0264-1)	Nessus	SuSE Local Security Checks	medium
46670	openSUSE Security Update : ncpfs (openSUSE-SU-2010:0264-1)	Nessus	SuSE Local Security Checks	medium
46669	openSUSE Security Update : ncpfs (openSUSE-SU-2010:0264-1)	Nessus	SuSE Local Security Checks	medium
45041	Mandriva Linux Security Advisory : ncpfs (MDVSA-2010:061)	Nessus	Mandriva Local Security Checks	low

Detections

Analytics

CVE-2010-0790

low

Tenable Plugins

medium

medium

medium

medium

medium

low