Bug 308073 (CVE-2010-0789)

Summary:	<sys-fs/fuse-2.8.5: symlink attack (CVE-2010-0789)
Product:	Gentoo Security	Reporter:	Stefan Behte (RETIRED) <craig>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	genstef, kernel-misc, sping
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://bugzilla.redhat.com/show_bug.cgi?id=532940
Whiteboard:	B3 [noglsa]
Package list:		Runtime testing required:	---

Description Stefan Behte (RETIRED) gentoo-dev

2010-03-06 16:00:17 UTC

CVE-2010-0789 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0789):
  fusermount in FUSE before 2.7.5, and 2.8.x before 2.8.2, allows local
  users to unmount an arbitrary FUSE filesystem share via a symlink
  attack on a mountpoint.

Comment 1 Sebastian Pipping gentoo-dev

2010-11-27 20:45:39 UTC

Looks like the current stable version sys-fs/fuse-2.8.1 is vulnerable.  We have 2.8.5 in the tree.  Anything I could do to speed processing up?

Comment 2 Tim Harder gentoo-dev

2010-11-29 00:41:09 UTC

(In reply to comment #1)
> Looks like the current stable version sys-fs/fuse-2.8.1 is vulnerable.  We have
> 2.8.5 in the tree.  Anything I could do to speed processing up?

We could start by doing a stable request. :)

Arches, please test and mark stable:
=sys-fs/fuse-2.8.5

Comment 3 Paweł Hajdan, Jr. (RETIRED) gentoo-dev

2010-11-29 08:51:20 UTC

x86 stable

Comment 4 Agostino Sarubbo gentoo-dev

2010-11-29 09:03:01 UTC

amd64 ok

Comment 5 Markos Chandras (RETIRED) gentoo-dev

2010-11-29 12:15:23 UTC

amd64 done. Thanks Agostino

Comment 6 Jeroen Roovers (RETIRED) gentoo-dev

2010-11-30 17:16:07 UTC

Stable for HPPA.

Comment 7 Raúl Porcel (RETIRED) gentoo-dev

2010-12-04 15:51:17 UTC

alpha/ia64/sparc stable

Comment 8 Jeroen Roovers (RETIRED) gentoo-dev

2010-12-07 18:06:00 UTC

Stable for PPC.

Comment 9 Brent Baude (RETIRED) gentoo-dev

2010-12-10 19:36:44 UTC

ppc64 done

Comment 10 Tim Sammut (RETIRED) gentoo-dev

2010-12-10 20:37:41 UTC

GLSA Vote: No.

Comment 11 Tim Harder gentoo-dev

2010-12-10 21:41:51 UTC

Insecure versions removed from the tree.

Comment 12 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev

2011-01-03 20:40:55 UTC

GLSA Vote: no -> Closing. Feel free to reopen if you disagree.