Multiple vulnerabilities have been discovered in LinuxCIFS utils, the worst of which can lead to local root privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-fs/cifs-utils | * | < 6.15 | >= 6.15 |
The LinuxCIFS utils are a collection of tools for managing Linux CIFS Client Filesystems.
Multiple vulnerabilities have been discovered in LinuxCIFS utils. Please review the CVE identifiers referenced below for details.
A stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root privileges. When verbose logging is enabled, invalid credentials file lines may be dumped to stderr. This may lead to information disclosure in particular conditions when the credentials file given is sensitive and contains '=' signs.
There is no known workaround at this time.
All LinuxCIFS utils users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-fs/cifs-utils-6.15"
A vulnerability in LinuxCIFS may allow a remote code execution via a command line option.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-fs/cifs-utils | * | < 6.11 | >= 6.11 |
The LinuxCIFS utils are a collection of tools for managing Linux CIFS Client Filesystems.
The mount.cifs utility had a shell injection issue where one can embed shell commands via the username mount option. Those commands will be run via popen() in the context of the user calling mount.
A remote attacker could entice a user to use a specially crafted argument using mount.cifs, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All LinuxCIFS users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-fs/cifs-utils-6.11"
A vulnerability in LinuxCIFS utils' "cifscreds" PAM module might allow remote attackers to have an unspecified impact via unknown vectors.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-fs/cifs-utils | * | < 6.4 | >= 6.4 |
The LinuxCIFS utils are a collection of tools for managing Linux CIFS Client Filesystems.
A stack-based buffer overflow was discovered in cifskey.c or cifscreds.c in LinuxCIFS, as used in “pam_cifscreds.”
A remote attacker could exploit this vulnerability to cause an unspecified impact.
Don’t use LinuxCIFS utils’ “cifscreds” PAM module. In Gentoo, LinuxCIFS utils’ PAM support is disabled by default unless the “pam” USE flag is enabled.
All LinuxCIFS utils users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-fs/cifs-utils-6.4"