410989 – (CVE-2012-1586) <net-fs/cifs-utils-5.4: Arbitrary file existence check as root (CVE-2012-1586)

Bug 410989 (CVE-2012-1586) - <net-fs/cifs-utils-5.4: Arbitrary file existence check as root (CVE-2012-1586)

Summary: <net-fs/cifs-utils-5.4: Arbitrary file existence check as root (CVE-2012-1586)

Status:	RESOLVED FIXED

Alias:	CVE-2012-1586

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:	https://bugzilla.samba.org/show_bug.c...
Whiteboard:	~4 [noglsa]
Keywords:

Depends on:
Blocks:

Reported:	2012-04-06 04:07 UTC by Tim Sammut (RETIRED)
Modified:	2012-09-05 11:56 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Tim Sammut (RETIRED) gentoo-dev

2012-04-06 04:07:10 UTC

From the upstream bug at $URL:

The mount.cifs binary, setuided by default in most of the linux distributions,
perform a privileged chdir() to the supplied directory, before the fstab check.

Then the user can deduce by the response, if is a existent file or a directory. 
This is setuided as root, then any user can identify /root/ files &
directories. 

$ /sbin/mount.cifs  //127.0.0.1/a  /root/secret_directory/secret_file

Comment 1 Víctor Ostorga (RETIRED) gentoo-dev

2012-04-09 21:00:23 UTC

Even though gentoo's cifs-utils is not installed setuid, I'll wait for upstream bug to be fixed before giving the "ok".

Comment 2 Víctor Ostorga (RETIRED) gentoo-dev

2012-04-23 20:34:58 UTC

Fixed in cifs-utils-5.4. All vulnerable versions are gone from tree. 

@security: go ahead

Comment 3 Tim Sammut (RETIRED) gentoo-dev

2012-04-30 21:42:02 UTC

Thanks, Victor.

Unless I am mistaken--always a possibility-- cifs-utils has never been stable. Rerating as ~4 and resolving as fixed.

Comment 4 GLSAMaker/CVETool Bot gentoo-dev

2012-09-05 11:56:53 UTC

CVE-2012-1586 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1586):
  mount.cifs in cifs-utils 2.6 allows local users to determine the existence
  of arbitrary files or directories via the file path in the second argument,
  which reveals their existence in an error message.