Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2018:3219-1

Опубликовано: 18 окт. 2018
Источник: suse-cvrf

Описание

Security update for fuse

This update for fuse fixes the following security issue:

  • CVE-2018-10906: fusermount was vulnerable to a restriction bypass when SELinux is active. This allowed non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system, accessible by other users, and trick them into accessing files on that file system, possibly causing Denial of Service or other unspecified effects (bsc#1101797)

Список пакетов

SUSE Linux Enterprise Desktop 12 SP3
fuse-2.9.3-6.3.1
libfuse2-2.9.3-6.3.1
SUSE Linux Enterprise Server 12 SP3
fuse-2.9.3-6.3.1
libfuse2-2.9.3-6.3.1
SUSE Linux Enterprise Server for SAP Applications 12 SP3
fuse-2.9.3-6.3.1
libfuse2-2.9.3-6.3.1
SUSE Linux Enterprise Software Development Kit 12 SP3
fuse-devel-2.9.3-6.3.1
fuse-devel-static-2.9.3-6.3.1
libulockmgr1-2.9.3-6.3.1

Ссылки

Описание

In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system, accessible by other users, and trick them into accessing files on that file system, possibly causing Denial of Service or other unspecified effects.

Затронутые продукты
SUSE Linux Enterprise Desktop 12 SP3:fuse-2.9.3-6.3.1
SUSE Linux Enterprise Desktop 12 SP3:libfuse2-2.9.3-6.3.1
SUSE Linux Enterprise Server 12 SP3:fuse-2.9.3-6.3.1
SUSE Linux Enterprise Server 12 SP3:libfuse2-2.9.3-6.3.1
Ссылки