CVE-2011-1585

low
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

The cifs_find_smb_ses function in fs/cifs/connect.c in the Linux kernel before 2.6.36 does not properly determine the associations between users and sessions, which allows local users to bypass CIFS share authentication by leveraging a mount of a share by a different user.

References

http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4ff67b720c02c36e54d55b88c2931879b7db1cd2

http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html

http://www.openwall.com/lists/oss-security/2011/04/15/8

https://bugzilla.redhat.com/show_bug.cgi?id=697394

https://github.com/torvalds/linux/commit/4ff67b720c02c36e54d55b88c2931879b7db1cd2

Details

Source: MITRE

Published: 2013-06-08

Updated: 2020-07-27

Type: CWE-264

Risk Information

CVSS v2

Base Score: 3.3

Vector: AV:L/AC:M/Au:N/C:P/I:P/A:N

Impact Score: 4.9

Exploitability Score: 3.4

Severity: LOW

Tenable Plugins

View all (29 total)

IDNameProductFamilySeverity
83723SUSE SLES10 Security Update : kernel (SUSE-SU-2015:0812-1)NessusSuSE Local Security Checks
high
79507OracleVM 2.2 : kernel (OVMSA-2013-0039)NessusOracleVM Local Security Checks
high
76634RHEL 6 : MRG (RHSA-2011:1253)NessusRed Hat Local Security Checks
high
75555openSUSE Security Update : kernel (openSUSE-SU-2011:0861-1)NessusSuSE Local Security Checks
high
68425Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2011-2037)NessusOracle Linux Local Security Checks
high
68375Oracle Linux 5 : kernel (ELSA-2011-1386)NessusOracle Linux Local Security Checks
critical
61162Scientific Linux Security Update : kernel on SL5.x i386/x86_64NessusScientific Linux Local Security Checks
critical
59159SuSE 10 Security Update : the Linux kernel (ZYPP Patch Number 7729)NessusSuSE Local Security Checks
critical
59158SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 7665)NessusSuSE Local Security Checks
high
59156SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 7515)NessusSuSE Local Security Checks
high
57213SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 7666)NessusSuSE Local Security Checks
high
57212SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 7516)NessusSuSE Local Security Checks
high
56948USN-1280-1 : linux-ti-omap4 vulnerabilitiesNessusUbuntu Local Security Checks
medium
56946Ubuntu 10.04 LTS : linux-lts-backport-maverick vulnerabilities (USN-1278-1)NessusUbuntu Local Security Checks
high
56914Ubuntu 10.10 : linux vulnerabilities (USN-1272-1)NessusUbuntu Local Security Checks
high
56913USN-1271-1 : linux-fsl-imx51 vulnerabilitiesNessusUbuntu Local Security Checks
medium
56911Ubuntu 8.04 LTS : linux vulnerabilities (USN-1268-1)NessusUbuntu Local Security Checks
high
56768Ubuntu 10.04 LTS : linux-lts-backport-natty vulnerabilities (USN-1256-1)NessusUbuntu Local Security Checks
critical
56607SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 7734)NessusSuSE Local Security Checks
critical
56577RHEL 5 : kernel (RHSA-2011:1386)NessusRed Hat Local Security Checks
critical
56569CentOS 5 : kernel (CESA-2011:1386)NessusCentOS Local Security Checks
critical
56343Ubuntu 10.04 LTS : linux vulnerabilities (USN-1218-1)NessusUbuntu Local Security Checks
high
56305Ubuntu 10.04 LTS : linux-ec2 vulnerabilities (USN-1216-1)NessusUbuntu Local Security Checks
high
56207Ubuntu 10.10 : linux-mvl-dove vulnerabilities (USN-1208-1)NessusUbuntu Local Security Checks
high
56191Ubuntu 10.04 LTS : linux-mvl-dove vulnerabilities (USN-1203-1)NessusUbuntu Local Security Checks
high
55686SuSE 11.1 Security Update : Linux kernel (SAT Patch Numbers 4884 / 4888 / 4889)NessusSuSE Local Security Checks
high
55468SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 7568)NessusSuSE Local Security Checks
high
55028Debian DSA-2240-1 : linux-2.6 - privilege escalation/denial of service/information leakNessusDebian Local Security Checks
high
801510CentOS RHSA-2011-1386 Security CheckLog Correlation EngineGeneric
high