Vulnerability CVE-2015-3202

Vulnerability CVE-2015-3202

Published: 2015-07-02

Description:

fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.

See advisories in our WLB2 database:

	Topic	Author	Date
High	Fuse Local Privilege Escalation	Tavis Ormandy	24.05.2015

Type:

CWE-264

(Permissions, Privileges, and Access Controls)

CVSS2 => (AV:L/AC:L/Au:N/C:N/I:P/A:P)

CVSS Base Score	Impact Subscore	Exploitability Subscore
3.6/10	4.9/10	3.9/10

Exploit range	Attack complexity	Authentication
Local	Low	No required
Confidentiality impact	Integrity impact	Availability impact
None	Partial	Partial

Affected software
Fuse project -> FUSE
Debian -> Debian linux

References:

http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159298.html

http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159543.html

http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159683.html

http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159831.html

http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160094.html

http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160106.html

http://lists.opensuse.org/opensuse-updates/2015-06/msg00005.html

http://lists.opensuse.org/opensuse-updates/2015-06/msg00007.html

http://packetstormsecurity.com/files/132021/Fuse-Local-Privilege-Escalation.html

http://www.debian.org/security/2015/dsa-3266

http://www.debian.org/security/2015/dsa-3268

http://www.openwall.com/lists/oss-security/2015/05/21/9

http://www.securityfocus.com/bid/74765

http://www.securitytracker.com/id/1032386

http://www.ubuntu.com/usn/USN-2617-1

http://www.ubuntu.com/usn/USN-2617-2

http://www.ubuntu.com/usn/USN-2617-3

https://gist.github.com/taviso/ecb70eb12d461dd85cba

https://security.gentoo.org/glsa/201603-04

https://security.gentoo.org/glsa/201701-19

https://twitter.com/taviso/status/601370527437967360

https://www.exploit-db.com/exploits/37089/

Vulnerability CVE-2015-3202

fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.

See advisories in our WLB2 database:

High

Fuse Local Privilege Escalation

CWE-264

CVSS2 => (AV:L/AC:L/Au:N/C:N/I:P/A:P)

3.6/10

4.9/10

3.9/10

Local

Low

No required

None

Partial

Partial

Affected software

References: