fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.

According to the version of the fuse packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - It was discovered that fusermount failed to properly     sanitize its environment before executing mount and     umount commands. A local user could possibly use this     flaw to escalate their privileges on the     system.(CVE-2015-3202)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the fuse packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - It was discovered that fusermount failed to properly     sanitize its environment before executing mount and     umount commands. A local user could possibly use this     flaw to escalate their privileges on the     system.(CVE-2015-3202)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the fuse packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - It was discovered that fusermount failed to properly     sanitize its environment before executing mount and     umount commands. A local user could possibly use this     flaw to escalate their privileges on the     system.(CVE-2015-3202)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the fuse packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - It was discovered that fusermount failed to properly     sanitize its environment before executing mount and     umount commands. A local user could possibly use this     flaw to escalate their privileges on the     system.i1/4^CVE-2015-3202i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201701-19 (NTFS-3G: Privilege escalation)

    NTFS-3G is affected by the same vulnerability as reported in &ldquo;GLSA       201603-04&rdquo; when the bundled fuse-lite implementation is used.
  Impact :

    A local user could gain root privileges.
  Workaround :

    There is no known workaround at this time. However, on Gentoo when the       &ldquo;external-fuse&rdquo; USE flag is set or the &ldquo;suid&rdquo; USE flag is not set       then NTFS-3G is not affected. Both of these cases are the default       configuration.

The remote host is affected by the vulnerability described in GLSA-201603-04 (FUSE: incorrect filtering of environment variables leading to privilege escalation)

    The fusermount binary calls setuid(geteuid()) to reset the RUID when it       invokes /bin/mount so that it can use privileged mount options that are       normally restricted if RUID != EUID.  FUSE does not properly clear       environment variables before invoking mount or umount as root allowing       this to be passed to operations using elevated privileges such as       LIBMOUNT_MTAB that is used by the mount commands debugging feature.
  Impact :

    The FUSE vulnerability allows a local, unprivileged user to overwrite       arbitrary files on the system.
  Workaround :

    There is no known work around at this time.

It was discovered that fusermount failed to properly sanitize its environment before executing mount and umount commands. A local user could possibly use this flaw to escalate their privileges on the system.

This update fixes a vulnerability in fuse that did not clear the environment upon execution of external programs. CVE-2015-3202 has been assigned to this issue

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 2.9.4, which fixes CVE-2015-3202.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix CVE-2015-3202.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for FUSE fixes the following security issue :

CVE-2015-3202: FUSE did not clear the environment upon execution of external programs.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Tavis Ormandy discovered that FUSE, a Filesystem in USErspace, does not scrub the environment before executing mount or umount with elevated privileges. A local user can take advantage of this flaw to overwrite arbitrary files and gain elevated privileges by accessing debugging features via the environment that would not normally be safe for unprivileged users.

For the old-oldstable distribution (squeeze-lts), this problem has been fixed in version 2.8.4-1.1+deb6u1.

We recommend that you upgrade your fuse packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Update to version 2.9.4

  - fix exec environment for mount and umount (bsc#931452,     CVE-2015-3202)

  - properly restore the default signal handler

  - fix directory file handle passed to&#9;ioctl() method.

  - fix for uids/gids larger than 2147483647

  - initialize stat buffer passed to getattr() and     fgetattr()

USN-2617-1 fixed a vulnerability in NTFS-3G. The original patch did not completely address the issue. This update fixes the problem.

Tavis Ormandy discovered that FUSE incorrectly filtered environment variables. A local attacker could use this issue to gain administrative privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The patch applied for ntfs-3g to fix CVE-2015-3202 in DLA 226-1 was incomplete. This update corrects that problem. For reference the original advisory text follows.

Tavis Ormandy discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing mount or umount with elevated privileges. A local user can take advantage of this flaw to overwrite arbitrary files and gain elevated privileges by accessing debugging features via the environment that would not normally be safe for unprivileged users.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-2617-1 fixed a vulnerability in FUSE. This update provides the corresponding fix for the embedded FUSE copy in NTFS-3G.

Tavis Ormandy discovered that FUSE incorrectly filtered environment variables. A local attacker could use this issue to gain administrative privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Tavis Ormandy discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing mount or umount with elevated privileges. A local user can take advantage of this flaw to overwrite arbitrary files and gain elevated privileges by accessing debugging features via the environment that would not normally be safe for unprivileged users.

Tavis Ormandy discovered that FUSE incorrectly filtered environment variables. A local attacker could use this issue to gain administrative privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Tavis Ormandy discovered that FUSE, a Filesystem in USErspace, does not scrub the environment before executing mount or umount with elevated privileges. A local user can take advantage of this flaw to overwrite arbitrary files and gain elevated privileges by accessing debugging features via the environment that would not normally be safe for unprivileged users.

ID	Name	Product	Family	Severity
125575	EulerOS Virtualization for ARM 64 3.0.2.0 : fuse (EulerOS-SA-2019-1623)	Nessus	Huawei Local Security Checks	low
125559	EulerOS Virtualization 3.0.1.0 : fuse (EulerOS-SA-2019-1607)	Nessus	Huawei Local Security Checks	low
125502	EulerOS 2.0 SP3 : fuse (EulerOS-SA-2019-1575)	Nessus	Huawei Local Security Checks	low
124729	EulerOS Virtualization 2.5.3 : fuse (EulerOS-SA-2019-1351)	Nessus	Huawei Local Security Checks	low
124383	EulerOS 2.0 SP5 : fuse (EulerOS-SA-2019-1287)	Nessus	Huawei Local Security Checks	low
124382	EulerOS 2.0 SP2 : fuse (EulerOS-SA-2019-1286)	Nessus	Huawei Local Security Checks	low
96413	GLSA-201701-19 : NTFS-3G: Privilege escalation	Nessus	Gentoo Local Security Checks	low
89810	GLSA-201603-04 : FUSE: incorrect filtering of environment variables leading to privilege escalation	Nessus	Gentoo Local Security Checks	low
84594	Amazon Linux AMI : fuse (ALAS-2015-558)	Nessus	Amazon Linux Local Security Checks	low
84192	SUSE SLED12 / SLES12 Security Update : fuse (SUSE-SU-2015:1053-1)	Nessus	SuSE Local Security Checks	low
84173	Fedora 20 : fuse-2.9.4-1.fc20 (2015-8782)	Nessus	Fedora Local Security Checks	low
84172	Fedora 20 : ntfs-3g-2015.3.14-2.fc20 (2015-8777)	Nessus	Fedora Local Security Checks	low
84115	SUSE SLED11 / SLES11 Security Update : FUSE (SUSE-SU-2015:1024-1)	Nessus	SuSE Local Security Checks	low
84064	Fedora 21 : fuse-2.9.4-1.fc21 (2015-8751)	Nessus	Fedora Local Security Checks	low
84036	Fedora 21 : ntfs-3g-2015.3.14-2.fc21 (2015-8771)	Nessus	Fedora Local Security Checks	low
84035	Fedora 22 : fuse-2.9.4-1.fc22 (2015-8756)	Nessus	Fedora Local Security Checks	low
84023	Debian DLA-238-1 : fuse security update	Nessus	Debian Local Security Checks	low
84014	openSUSE Security Update : fuse (openSUSE-2015-401)	Nessus	SuSE Local Security Checks	low
83982	openSUSE Security Update : fuse (openSUSE-2015-394)	Nessus	SuSE Local Security Checks	low
83935	Fedora 22 : ntfs-3g-2015.3.14-2.fc22 (2015-8773)	Nessus	Fedora Local Security Checks	low
83861	Ubuntu 15.04 : ntfs-3g vulnerability (USN-2617-3)	Nessus	Ubuntu Local Security Checks	low
83819	Debian DLA-226-2 : ntfs-3g regression update	Nessus	Debian Local Security Checks	low
83809	Ubuntu 15.04 : ntfs-3g vulnerability (USN-2617-2)	Nessus	Ubuntu Local Security Checks	low
83785	Debian DSA-3268-1 : ntfs-3g - security update	Nessus	Debian Local Security Checks	low
83779	Ubuntu 14.04 LTS : FUSE vulnerability (USN-2617-1)	Nessus	Ubuntu Local Security Checks	critical
83775	Debian DSA-3266-1 : fuse - security update	Nessus	Debian Local Security Checks	low

Detections

Analytics

CVE-2015-3202

critical

Tenable Plugins

low

low

low

low

low

low

low

low

low

low

low

low

low

low

low

low

low

low

low

low

low

low

low

low

critical

low