Mandrake Linux Security Advisory : fuse (MDKSA-2005:216)

Low Nessus Plugin ID 20448


The remote Mandrake Linux host is missing one or more security updates.


Thomas Beige found that fusermount failed to securely handle special characters specified in mount points, which could allow a local attacker to corrupt the contents of /etc/mtab by mounting over a maliciously-named directory using fusermount. This could potentially allow the attacker to set unauthorized mount options.

This is only possible when fusermount is installed setuid root, which is the case in Mandriva Linux.

The updated packages have been patched to address these problems.


Update the affected packages.

Plugin Details

Severity: Low

ID: 20448

File Name: mandrake_MDKSA-2005-216.nasl

Version: $Revision: 1.11 $

Type: local

Published: 2006/01/15

Modified: 2013/05/31

Dependencies: 12634

Risk Information

Risk Factor: Low


Base Score: 2.1

Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:dkms-fuse, p-cpe:/a:mandriva:linux:fuse, p-cpe:/a:mandriva:linux:lib64fuse2, p-cpe:/a:mandriva:linux:lib64fuse2-devel, p-cpe:/a:mandriva:linux:lib64fuse2-static-devel, p-cpe:/a:mandriva:linux:libfuse2, p-cpe:/a:mandriva:linux:libfuse2-devel, p-cpe:/a:mandriva:linux:libfuse2-static-devel, cpe:/o:mandriva:linux:2006

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Patch Publication Date: 2005/11/24

Reference Information

CVE: CVE-2005-3531

MDKSA: 2005:216