utils/mount.ecryptfs_private.c in ecryptfs-utils before 90 does not properly check mountpoint permissions, which allows local users to remove directories via a umount system call.

This update of ecryptfs-utils fixes several security problems :

  - CVE-2011-1831 - Race condition when checking mountpoint     during mount.

  - CVE-2011-1832 - Race condition when checking mountpoint     during unmount.

  - CVE-2011-1833 - Race condition when checking source     during mount.

  - CVE-2011-1834 - Improper mtab handling allowing     corruption due to resource limits, signals, etc.

  - CVE-2011-1835 - Key poisoning in ecryptfs-setup-private     due to insecure temp directory.

  - CVE-2011-1837 - Predictable lock counter name and     associated races.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-1241 advisory.

  - utils/mount.ecryptfs_private.c in ecryptfs-utils before 90 does not properly check mountpoint permissions,     which allows local users to effectively replace any directory with a new filesystem, and consequently gain     privileges, via a mount system call. (CVE-2011-1831)

  - utils/mount.ecryptfs_private.c in ecryptfs-utils before 90 does not properly check mountpoint permissions,     which allows local users to remove directories via a umount system call. (CVE-2011-1832)

  - utils/mount.ecryptfs_private.c in ecryptfs-utils before 90 does not properly maintain the mtab file during     error conditions, which allows local users to cause a denial of service (table corruption) or bypass     intended unmounting restrictions via a umount system call. (CVE-2011-1834)

  - The encrypted private-directory setup process in utils/ecryptfs-setup-private in ecryptfs-utils before 90     does not properly ensure that the passphrase file is created, which might allow local users to bypass     intended access restrictions at a certain time in the new-user creation steps. (CVE-2011-1835)

  - The lock-counter implementation in utils/mount.ecryptfs_private.c in ecryptfs-utils before 90 allows local     users to overwrite arbitrary files via unspecified vectors. (CVE-2011-1837)

  - When mount.ecrpytfs_private before version 87-0ubuntu1.2 calls setreuid() it doesn't also set the     effective group id. So when it creates the new version, mtab.tmp, it's created with the group id of the     user running mount.ecryptfs_private. (CVE-2011-3145)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several problems have been discovered in eCryptfs, a cryptographic filesystem for Linux.

  - CVE-2011-1831     Vasiliy Kulikov of Openwall and Dan Rosenberg discovered     that eCryptfs incorrectly validated permissions on the     requested mountpoint. A local attacker could use this     flaw to mount to arbitrary locations, leading to     privilege escalation.

  - CVE-2011-1832     Vasiliy Kulikov of Openwall and Dan Rosenberg discovered     that eCryptfs incorrectly validated permissions on the     requested mountpoint. A local attacker could use this     flaw to unmount to arbitrary locations, leading to a     denial of service.

  - CVE-2011-1834     Dan Rosenberg and Marc Deslauriers discovered that     eCryptfs incorrectly handled modifications to the mtab     file when an error occurs. A local attacker could use     this flaw to corrupt the mtab file, and possibly unmount     arbitrary locations, leading to a denial of service.

  - CVE-2011-1835     Marc Deslauriers discovered that eCryptfs incorrectly     handled keys when setting up an encrypted private     directory. A local attacker could use this flaw to     manipulate keys during creation of a new user.

  - CVE-2011-1837     Vasiliy Kulikov of Openwall discovered that eCryptfs     incorrectly handled lock counters. A local attacker     could use this flaw to possibly overwrite arbitrary     files.

We acknowledge the work of the Ubuntu distribution in preparing patches suitable for near-direct inclusion in the Debian package.

Updated ecryptfs-utils packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

eCryptfs is a stacked, cryptographic file system. It is transparent to the underlying file system and provides per-file granularity. eCryptfs is released as a Technology Preview for Red Hat Enterprise Linux 5 and 6.

The setuid mount.ecryptfs_private utility allows users to mount an eCryptfs file system. This utility can only be run by users in the 'ecryptfs' group.

A race condition flaw was found in the way mount.ecryptfs_private checked the permissions of a requested mount point when mounting an encrypted file system. A local attacker could possibly use this flaw to escalate their privileges by mounting over an arbitrary directory.
(CVE-2011-1831)

A race condition flaw in umount.ecryptfs_private could allow a local attacker to unmount an arbitrary file system. (CVE-2011-1832)

It was found that mount.ecryptfs_private did not handle certain errors correctly when updating the mtab (mounted file systems table) file, allowing a local attacker to corrupt the mtab file and possibly unmount an arbitrary file system. (CVE-2011-1834)

An insecure temporary file use flaw was found in the ecryptfs-setup-private script. A local attacker could use this script to insert their own key that will subsequently be used by a new user, possibly giving the attacker access to the user's encrypted data if existing file permissions allow access. (CVE-2011-1835)

A race condition flaw in mount.ecryptfs_private could allow a local attacker to overwrite arbitrary files. (CVE-2011-1837)

A race condition flaw in the way temporary files were accessed in mount.ecryptfs_private could allow a malicious, local user to make arbitrary modifications to the mtab file. (CVE-2011-3145)

A race condition flaw was found in the way mount.ecryptfs_private checked the permissions of the directory to mount. A local attacker could use this flaw to mount (and then access) a directory they would otherwise not have access to. Note: The fix for this issue is incomplete until a kernel-space change is made. Future Red Hat Enterprise Linux 5 and 6 kernel updates will correct this issue.
(CVE-2011-1833)

Red Hat would like to thank the Ubuntu Security Team for reporting these issues. The Ubuntu Security Team acknowledges Vasiliy Kulikov of Openwall and Dan Rosenberg as the original reporters of CVE-2011-1831, CVE-2011-1832, and CVE-2011-1833; Dan Rosenberg and Marc Deslauriers as the original reporters of CVE-2011-1834; Marc Deslauriers as the original reporter of CVE-2011-1835; and Vasiliy Kulikov of Openwall as the original reporter of CVE-2011-1837.

Users of ecryptfs-utils are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

- privilege escalation via mountpoint race conditions     (CVE-2011-1831, CVE-2011-1832)

    - race condition when checking source during mount       (CVE-2011-1833)

    - mtab corruption via improper handling (CVE-2011-1834)

    - key poisoning via insecure temp directory handling       (CVE-2011-1835)

    - information disclosure via recovery mount in /tmp       (CVE-2011-1836)

    - arbitrary file overwrite via lock counter race       (CVE-2011-1837)

  - improve logging messages of ecryptfs pam module

    - keep own copy of passphrase, pam clears it too early

    - keyring from auth stack does not survive, use pam_data       and delayed keyring initialization

    - keyring from auth stack does not survive, use pam_data       and delayed keyring initialization

    - keyring from auth stack does not survive, use pam_data       and delayed keyring initialization

    - improve logging messages of ecryptfs pam module

    - keep own copy of passphrase, pam clears it too early

    - keyring from auth stack does not survive, use pam_data       and delayed keyring initialization

    - keyring from auth stack does not survive, use pam_data       and delayed keyring initialization

    - keyring from auth stack does not survive, use pam_data       and delayed keyring initialization

    - improve logging messages of ecryptfs pam module

    - keep own copy of passphrase, pam clears it too early

    - keyring from auth stack does not survive, use pam_data       and delayed keyring initialization

    - keyring from auth stack does not survive, use pam_data       and delayed keyring initialization

    - keyring from auth stack does not survive, use pam_data       and delayed keyring initialization

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:1241 advisory.

  - ecryptfs: multiple flaws to mount/umount arbitrary locations and possibly disclose confidential     information (CVE-2011-1831, CVE-2011-1832, CVE-2011-1834, CVE-2011-1835, CVE-2011-1837)

  - ecryptfs-utils: incorrect mtab group ownership (CVE-2011-3145)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update of ecryptfs-utils fixes several security problems :

  - Race condition when checking mountpoint during mount.
    (CVE-2011-1831)

  - Race condition when checking mountpoint during unmount.
    (CVE-2011-1832)

  - Race condition when checking source during mount.
    (CVE-2011-1833)

  - Improper mtab handling allowing corruption due to     resource limits, signals, etc. (CVE-2011-1834)

Vasiliy Kulikov and Dan Rosenberg discovered that eCryptfs incorrectly validated permissions on the requested mountpoint. A local attacker could use this flaw to mount to arbitrary locations, leading to privilege escalation. (CVE-2011-1831)

Vasiliy Kulikov and Dan Rosenberg discovered that eCryptfs incorrectly validated permissions on the requested mountpoint. A local attacker could use this flaw to unmount to arbitrary locations, leading to a denial of service. (CVE-2011-1832)

Vasiliy Kulikov and Dan Rosenberg discovered that eCryptfs incorrectly validated permissions on the requested source directory. A local attacker could use this flaw to mount an arbitrary directory, possibly leading to information disclosure. A pending kernel update will provide the other half of the fix for this issue. (CVE-2011-1833)

Dan Rosenberg and Marc Deslauriers discovered that eCryptfs incorrectly handled modifications to the mtab file when an error occurs. A local attacker could use this flaw to corrupt the mtab file, and possibly unmount arbitrary locations, leading to a denial of service. (CVE-2011-1834)

Marc Deslauriers discovered that eCryptfs incorrectly handled keys when setting up an encrypted private directory. A local attacker could use this flaw to manipulate keys during creation of a new user.
(CVE-2011-1835)

Marc Deslauriers discovered that eCryptfs incorrectly handled permissions during recovery. A local attacker could use this flaw to possibly access another user's data during the recovery process. This issue only applied to Ubuntu 11.04. (CVE-2011-1836)

Vasiliy Kulikov discovered that eCryptfs incorrectly handled lock counters. A local attacker could use this flaw to possibly overwrite arbitrary files. The default symlink restrictions in Ubuntu 10.10 and 11.04 should protect against this issue. (CVE-2011-1837).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75821	openSUSE Security Update : ecryptfs-utils (openSUSE-SU-2011:0902-1)	Nessus	SuSE Local Security Checks	medium
75473	openSUSE Security Update : ecryptfs-utils (openSUSE-SU-2011:0902-1)	Nessus	SuSE Local Security Checks	medium
68338	Oracle Linux 5 / 6 : ecryptfs-utils (ELSA-2011-1241)	Nessus	Oracle Linux Local Security Checks	critical
57522	Debian DSA-2382-1 : ecryptfs-utils - multiple vulnerabilities	Nessus	Debian Local Security Checks	critical
56273	CentOS 5 : ecryptfs-utils (CESA-2011:1241)	Nessus	CentOS Local Security Checks	critical
56095	Fedora 16 : ecryptfs-utils-90-1.fc16 (2011-10671)	Nessus	Fedora Local Security Checks	medium
56076	Fedora 15 : ecryptfs-utils-90-1.fc15 (2011-10733)	Nessus	Fedora Local Security Checks	medium
56075	Fedora 14 : ecryptfs-utils-90-1.fc14 (2011-10718)	Nessus	Fedora Local Security Checks	medium
56028	RHEL 5 / 6 : ecryptfs-utils (RHSA-2011:1241)	Nessus	Red Hat Local Security Checks	critical
55827	SuSE 11.1 Security Update : ecryptfs-utils (SAT Patch Number 4956)	Nessus	SuSE Local Security Checks	medium
55810	Ubuntu 10.04 LTS / 10.10 / 11.04 : ecryptfs-utils vulnerabilities (USN-1188-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2011-1832

critical

Tenable Plugins

medium

medium

critical

critical

critical

medium

medium

medium

critical

medium

medium