When mount.ecrpytfs_private before version 87-0ubuntu1.2 calls setreuid() it doesn't also set the effective group id. So when it creates the new version, mtab.tmp, it's created with the group id of the user running mount.ecryptfs_private.

mount.ecrpytfs_private did not set correct group ownerships when it modifies mtab (CVE-2011-3145).

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-1241 advisory.

  - utils/mount.ecryptfs_private.c in ecryptfs-utils before 90 does not properly check mountpoint permissions,     which allows local users to effectively replace any directory with a new filesystem, and consequently gain     privileges, via a mount system call. (CVE-2011-1831)

  - utils/mount.ecryptfs_private.c in ecryptfs-utils before 90 does not properly check mountpoint permissions,     which allows local users to remove directories via a umount system call. (CVE-2011-1832)

  - utils/mount.ecryptfs_private.c in ecryptfs-utils before 90 does not properly maintain the mtab file during     error conditions, which allows local users to cause a denial of service (table corruption) or bypass     intended unmounting restrictions via a umount system call. (CVE-2011-1834)

  - The encrypted private-directory setup process in utils/ecryptfs-setup-private in ecryptfs-utils before 90     does not properly ensure that the passphrase file is created, which might allow local users to bypass     intended access restrictions at a certain time in the new-user creation steps. (CVE-2011-1835)

  - The lock-counter implementation in utils/mount.ecryptfs_private.c in ecryptfs-utils before 90 allows local     users to overwrite arbitrary files via unspecified vectors. (CVE-2011-1837)

  - When mount.ecrpytfs_private before version 87-0ubuntu1.2 calls setreuid() it doesn't also set the     effective group id. So when it creates the new version, mtab.tmp, it's created with the group id of the     user running mount.ecryptfs_private. (CVE-2011-3145)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ecryptfs-utils was updated to fix a security issue and some bugs.

Security issue fixed: mount.ecryptfs_private did not set correct group ownerships when it modifies mtab. (CVE-2011-3145)

Also some bugs that made this set of tools non-working were fixed.

You need to manually hand setuid root permissions to /sbin/mount.ecryptfs_private if you want to use it as a non-root user.

eCryptfs is a stacked, cryptographic file system. It is transparent to the underlying file system and provides per-file granularity.

The setuid mount.ecryptfs_private utility allows users to mount an eCryptfs file system. This utility can only be run by users in the 'ecryptfs' group.

A race condition flaw was found in the way mount.ecryptfs_private checked the permissions of a requested mount point when mounting an encrypted file system. A local attacker could possibly use this flaw to escalate their privileges by mounting over an arbitrary directory.
(CVE-2011-1831)

A race condition flaw in umount.ecryptfs_private could allow a local attacker to unmount an arbitrary file system. (CVE-2011-1832)

It was found that mount.ecryptfs_private did not handle certain errors correctly when updating the mtab (mounted file systems table) file, allowing a local attacker to corrupt the mtab file and possibly unmount an arbitrary file system. (CVE-2011-1834)

An insecure temporary file use flaw was found in the ecryptfs-setup-private script. A local attacker could use this script to insert their own key that will subsequently be used by a new user, possibly giving the attacker access to the user's encrypted data if existing file permissions allow access. (CVE-2011-1835)

A race condition flaw in mount.ecryptfs_private could allow a local attacker to overwrite arbitrary files. (CVE-2011-1837)

A race condition flaw in the way temporary files were accessed in mount.ecryptfs_private could allow a malicious, local user to make arbitrary modifications to the mtab file. (CVE-2011-3145)

A race condition flaw was found in the way mount.ecryptfs_private checked the permissions of the directory to mount. A local attacker could use this flaw to mount (and then access) a directory they would otherwise not have access to. Note: The fix for this issue is incomplete until a kernel-space change is made. Future Scientific Linux 5 and 6 kernel updates will correct this issue. (CVE-2011-1833)

Users of ecryptfs-utils are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

Several problems have been discovered in eCryptfs, a cryptographic filesystem for Linux.

  - CVE-2011-1831     Vasiliy Kulikov of Openwall and Dan Rosenberg discovered     that eCryptfs incorrectly validated permissions on the     requested mountpoint. A local attacker could use this     flaw to mount to arbitrary locations, leading to     privilege escalation.

  - CVE-2011-1832     Vasiliy Kulikov of Openwall and Dan Rosenberg discovered     that eCryptfs incorrectly validated permissions on the     requested mountpoint. A local attacker could use this     flaw to unmount to arbitrary locations, leading to a     denial of service.

  - CVE-2011-1834     Dan Rosenberg and Marc Deslauriers discovered that     eCryptfs incorrectly handled modifications to the mtab     file when an error occurs. A local attacker could use     this flaw to corrupt the mtab file, and possibly unmount     arbitrary locations, leading to a denial of service.

  - CVE-2011-1835     Marc Deslauriers discovered that eCryptfs incorrectly     handled keys when setting up an encrypted private     directory. A local attacker could use this flaw to     manipulate keys during creation of a new user.

  - CVE-2011-1837     Vasiliy Kulikov of Openwall discovered that eCryptfs     incorrectly handled lock counters. A local attacker     could use this flaw to possibly overwrite arbitrary     files.

We acknowledge the work of the Ubuntu distribution in preparing patches suitable for near-direct inclusion in the Debian package.

- fix incorrect mtab group ownership

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated ecryptfs-utils packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

eCryptfs is a stacked, cryptographic file system. It is transparent to the underlying file system and provides per-file granularity. eCryptfs is released as a Technology Preview for Red Hat Enterprise Linux 5 and 6.

The setuid mount.ecryptfs_private utility allows users to mount an eCryptfs file system. This utility can only be run by users in the 'ecryptfs' group.

A race condition flaw was found in the way mount.ecryptfs_private checked the permissions of a requested mount point when mounting an encrypted file system. A local attacker could possibly use this flaw to escalate their privileges by mounting over an arbitrary directory.
(CVE-2011-1831)

A race condition flaw in umount.ecryptfs_private could allow a local attacker to unmount an arbitrary file system. (CVE-2011-1832)

It was found that mount.ecryptfs_private did not handle certain errors correctly when updating the mtab (mounted file systems table) file, allowing a local attacker to corrupt the mtab file and possibly unmount an arbitrary file system. (CVE-2011-1834)

An insecure temporary file use flaw was found in the ecryptfs-setup-private script. A local attacker could use this script to insert their own key that will subsequently be used by a new user, possibly giving the attacker access to the user's encrypted data if existing file permissions allow access. (CVE-2011-1835)

A race condition flaw in mount.ecryptfs_private could allow a local attacker to overwrite arbitrary files. (CVE-2011-1837)

A race condition flaw in the way temporary files were accessed in mount.ecryptfs_private could allow a malicious, local user to make arbitrary modifications to the mtab file. (CVE-2011-3145)

A race condition flaw was found in the way mount.ecryptfs_private checked the permissions of the directory to mount. A local attacker could use this flaw to mount (and then access) a directory they would otherwise not have access to. Note: The fix for this issue is incomplete until a kernel-space change is made. Future Red Hat Enterprise Linux 5 and 6 kernel updates will correct this issue.
(CVE-2011-1833)

Red Hat would like to thank the Ubuntu Security Team for reporting these issues. The Ubuntu Security Team acknowledges Vasiliy Kulikov of Openwall and Dan Rosenberg as the original reporters of CVE-2011-1831, CVE-2011-1832, and CVE-2011-1833; Dan Rosenberg and Marc Deslauriers as the original reporters of CVE-2011-1834; Marc Deslauriers as the original reporter of CVE-2011-1835; and Vasiliy Kulikov of Openwall as the original reporter of CVE-2011-1837.

Users of ecryptfs-utils are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:1241 advisory.

  - ecryptfs: multiple flaws to mount/umount arbitrary locations and possibly disclose confidential     information (CVE-2011-1831, CVE-2011-1832, CVE-2011-1834, CVE-2011-1835, CVE-2011-1837)

  - ecryptfs-utils: incorrect mtab group ownership (CVE-2011-3145)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that eCryptfs incorrectly handled permissions when modifying the mtab file. A local attacker could use this flaw to manipulate the mtab file, and possibly unmount arbitrary locations, leading to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75822	openSUSE Security Update : ecryptfs-utils (openSUSE-SU-2012:0106-1)	Nessus	SuSE Local Security Checks	critical
75474	openSUSE Security Update : ecryptfs-utils (openSUSE-SU-2012:0106-1)	Nessus	SuSE Local Security Checks	critical
68338	Oracle Linux 5 / 6 : ecryptfs-utils (ELSA-2011-1241)	Nessus	Oracle Linux Local Security Checks	critical
64126	SuSE 11.1 Security Update : ecryptfs-utils (SAT Patch Number 6187)	Nessus	SuSE Local Security Checks	high
61124	Scientific Linux Security Update : ecryptfs-utils on SL5.x, SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
57522	Debian DSA-2382-1 : ecryptfs-utils - multiple vulnerabilities	Nessus	Debian Local Security Checks	critical
56349	Fedora 16 : ecryptfs-utils-90-2.fc16 (2011-11871)	Nessus	Fedora Local Security Checks	critical
56273	CentOS 5 : ecryptfs-utils (CESA-2011:1241)	Nessus	CentOS Local Security Checks	critical
56201	Fedora 14 : ecryptfs-utils-90-2.fc14 (2011-11979)	Nessus	Fedora Local Security Checks	critical
56200	Fedora 15 : ecryptfs-utils-90-2.fc15 (2011-11936)	Nessus	Fedora Local Security Checks	critical
56028	RHEL 5 / 6 : ecryptfs-utils (RHSA-2011:1241)	Nessus	Red Hat Local Security Checks	critical
55968	Ubuntu 10.04 LTS / 10.10 / 11.04 : ecryptfs-utils vulnerability (USN-1196-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2011-3145

critical

Tenable Plugins

critical

critical

critical

high

critical

critical

critical

critical

critical

critical

critical

critical