Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 335871 (CVE-2010-0296) - <sys-libs/glibc-2.11.2: encode_name macro input validation (CVE-2010-0296)
Summary: <sys-libs/glibc-2.11.2: encode_name macro input validation (CVE-2010-0296)
Status: RESOLVED FIXED
Alias: CVE-2010-0296
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: A3 [glsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2010-09-03 20:52 UTC by Stefan Behte (RETIRED)
Modified: 2010-11-15 21:33 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Stefan Behte (RETIRED) gentoo-dev Security 2010-09-03 20:52:30 UTC 
CVE-2010-0296 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0296):
  The encode_name macro in misc/mntent_r.c in the GNU C Library (aka
  glibc or libc6) 2.11.1 and earlier, as used by ncpmount and
  mount.cifs, does not properly handle newline characters in mountpoint
  names, which allows local users to cause a denial of service (mtab
  corruption), or possibly modify mount options and gain privileges,
  via a crafted mount request.
Comment 1 Stefan Behte (RETIRED) gentoo-dev Security 2010-09-03 20:53:14 UTC 
Please advice if it's already patched, you always seem to know this anyways... ;)
Comment 2 SpanKY gentoo-dev 2010-09-03 21:08:11 UTC 
the fix is already in glibc-2.11.2 which is stable for most everyone ... maybe only hppa/s390 still need keywording
Comment 3 Tobias Heinlein (RETIRED) gentoo-dev 2010-11-15 21:33:51 UTC 
This is GLSA 201011-01, thanks everyone, and sorry about the delay.