oss-security - CVE-2011-2724 assignment notification -- samba -- incomplete fix for CVE-2010-0547 issue

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <4E32CD19.6010608@redhat.com>
Date: Fri, 29 Jul 2011 17:09:13 +0200
From: Jan Lieskovsky <jlieskov@...hat.com>
To: "Steven M. Christey" <coley@...us.mitre.org>
CC: oss-security@...ts.openwall.com, Jeffrey Layton <jlayton@...hat.com>
Subject: CVE-2011-2724 assignment notification -- samba -- incomplete fix
 for CVE-2010-0547 issue

Hello Josh, Steve, vendors,

   during creation of automated test case for samba CVE-2010-0547 issue 
I have noticed still to be possible mount.cifs to succeed to mount Samba 
share to specially-crafted mount point (containing newline character), 
potentially resulting into mtab corruption (on systems, where glibc 
package was not patched against CVE-2010-0296 flaw yet).

The new CVE identifier of CVE-2011-2724 has been assigned to this issue
(as an incomplete fix for CVE-2010-0547 issue).

Kudos to Tomas Hoger and Jeffrey Layton for their analysis of the issue:

check_mtab() calls check_newline() to check device and directory name.
check_newline() returns EX_USAGE (1) when error is detected, while 
check_mtab() expects -1 to indicate an error.

and to Jeffrey Layton again for providing the patch almost immediately:
[1] http://comments.gmane.org/gmane.linux.kernel.cifs/3827

References:
[2] https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2724

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.