Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2019:13948-1

Опубликовано: 08 фев. 2019
Источник: suse-cvrf

Описание

Security update for fuse

This update for fuse fixes the following issues:

Security issue fixed:

  • CVE-2018-10906: Fix a bypass of the user_allow_other restriction (bsc#1101797)

Список пакетов

SUSE Linux Enterprise Server 11 SP4
fuse-2.8.7-0.11.3.1
libfuse2-2.8.7-0.11.3.1
SUSE Linux Enterprise Server for SAP Applications 11 SP4
fuse-2.8.7-0.11.3.1
libfuse2-2.8.7-0.11.3.1
SUSE Linux Enterprise Software Development Kit 11 SP4
fuse-devel-2.8.7-0.11.3.1

Ссылки

Описание

In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system, accessible by other users, and trick them into accessing files on that file system, possibly causing Denial of Service or other unspecified effects.

Затронутые продукты
SUSE Linux Enterprise Server 11 SP4:fuse-2.8.7-0.11.3.1
SUSE Linux Enterprise Server 11 SP4:libfuse2-2.8.7-0.11.3.1
SUSE Linux Enterprise Server for SAP Applications 11 SP4:fuse-2.8.7-0.11.3.1
SUSE Linux Enterprise Server for SAP Applications 11 SP4:libfuse2-2.8.7-0.11.3.1
Ссылки