Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2021:0639-1

Опубликовано: 30 апр. 2021
Источник: suse-cvrf

Описание

Security update for cifs-utils

This update for cifs-utils fixes the following security issues:

  • CVE-2021-20208: Fixed a potential kerberos auth leak escaping from container. (bsc#1183239)
  • CVE-2020-14342: Fixed a shell command injection vulnerability in mount.cifs. (bsc#1174477)

This update for cifs-utils fixes the following issues:

  • Solve invalid directory mounting. When attempting to change the current working directory into non-existing directories, mount.cifs crashes. (bsc#1152930)

  • Fixed a bug where it was no longer possible to mount CIFS filesystem after the last maintenance update. (bsc#1184815)

This update was imported from the SUSE:SLE-15:Update update project.

Список пакетов

openSUSE Leap 15.2
cifs-utils-6.9-lp152.2.3.1
cifs-utils-devel-6.9-lp152.2.3.1
pam_cifscreds-6.9-lp152.2.3.1

Ссылки

Описание

It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.

Затронутые продукты
openSUSE Leap 15.2:cifs-utils-6.9-lp152.2.3.1
openSUSE Leap 15.2:cifs-utils-devel-6.9-lp152.2.3.1
openSUSE Leap 15.2:pam_cifscreds-6.9-lp152.2.3.1
Ссылки

Описание

A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to data confidentiality and integrity.

Затронутые продукты
openSUSE Leap 15.2:cifs-utils-6.9-lp152.2.3.1
openSUSE Leap 15.2:cifs-utils-devel-6.9-lp152.2.3.1
openSUSE Leap 15.2:pam_cifscreds-6.9-lp152.2.3.1
Ссылки