Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
First Last Prev Next    This bug is not in your last search results.
Bug 730964 - (CVE-2011-1836) CVE-2011-1836 ecryptfs-utils: ecryptfs-recover-private insecure permissions on the temporary mount point
CVE-2011-1836 ecryptfs-utils: ecryptfs-recover-private insecure permissions o...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
public=20110809,reported=20110801,sou...
: Security
Depends On: 729474
Blocks: 729476
  Show dependency tree / graph
 
Reported: 2011-08-16 08:05 EDT by Tomas Hoger
Modified: 2015-07-31 02:43 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-08-08 06:58:07 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

  None (edit)
Description Tomas Hoger 2011-08-16 08:05:34 EDT 
Quoting Ubuntu advisory:

Marc Deslauriers discovered that eCryptfs incorrectly handled permissions during recovery. A local attacker could use this flaw to possibly access another user's data during the recovery process. This issue only applied to Ubuntu 11.04. (CVE-2011-1836)

References:
http://www.ubuntu.com/usn/usn-1188-1/
https://launchpad.net/bugs/732628

Patch is attached in the bug that track other issues from the advisory:
https://bugzilla.redhat.com/show_bug.cgi?id=729465#c4
Comment 1 Tomas Hoger 2011-08-16 08:09:03 EDT 
As was noted in bug #729465, comment #8:

CVE-2011-1836 only affects Fedora; ecryptfs-recover-private does not exist in
ecryptfs-utils-82 (which is what is shipped with Red Hat Enterprise Linux 6).

Statement:

Not vulnerable. This issue did not affect the versions of ecryptfs-utils as
shipped with Red Hat Enterprise Linux 5 or 6.
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.