Bug 526074 (CVE-2009-2948) - CVE-2009-2948 samba: information disclosure in suid mount.cifs
Summary: CVE-2009-2948 samba: information disclosure in suid mount.cifs
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2009-2948
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 526658 526659 526660 526661 526663
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-09-28 16:58 UTC by Vincent Danen
Modified: 2019-09-29 12:32 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2009-11-19 15:00:57 UTC
Embargoed:

Attachments (Terms of Use)
upstream patches to correct CVE-2009-2948 for samba 3.0.36, 3.2.14, 3.4.1 (3.66 KB, application/x-bzip2)
2009-09-28 17:05 UTC, Vincent Danen 		no flags Details
patch -- backports of upstream patches (17.29 KB, patch)
2009-10-02 14:35 UTC, Jeff Layton 		no flags Details | Diff
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2009:1529 0 normal SHIPPED_LIVE Moderate: samba security update 2009-10-27 17:11:52 UTC
Red Hat Product Errata RHSA-2009:1585 0 normal SHIPPED_LIVE Moderate: samba3x security and bug fix update 2009-11-16 15:39:53 UTC

Description Vincent Danen 2009-09-28 16:58:06 UTC 
A flaw in the mount.cifs program, when installed suid, prevents it from checking user's privileges when provided a password or credential path, prior to obtaining root privileges.  This allows a user to use a password or credential file to which they would not have access.  As well, when the --verbose option is provided, the user can view the first line of that file.
Comment 1 Vincent Danen 2009-09-28 17:05:35 UTC 
Created attachment 362916 [details]
upstream patches to correct CVE-2009-2948 for samba 3.0.36, 3.2.14, 3.4.1
Comment 2 Vincent Danen 2009-09-28 17:11:58 UTC 
This issue does not affect Red Hat Enterprise Linux 4 and 5 by default as mount.cifs is not provided with the setuid bit enabled.  If a user has turned on the setuid bit (via 'chmod +s /sbin/mount.cifs'), they would be affected by this issue and can workaround the problem by removing the setuid bit.

Red Hat Enterprise Linux 3 does not provide the mount.cifs program.

The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw.  More information regarding issue severity can be found here:

http://www.redhat.com/security/updates/classification/
Comment 3 Tomas Hoger 2009-10-01 10:08:10 UTC 
Upstream advisory:
  http://www.samba.org/samba/security/CVE-2009-2948.html

Fixed upstream in versions: 3.0.37, 3.2.15, 3.3.8 and 3.4.2
Comment 6 Jeff Layton 2009-10-02 14:35:37 UTC 
Created attachment 363489 [details]
patch -- backports of upstream patches

This is a backport of the 2 upstream patches for this CVE, plus an older patch that I pulled in to make the others apply more cleanly.

I've given it some basic smoke testing and it seems to work ok.
Comment 7 Fedora Update System 2009-10-03 18:57:34 UTC 
samba-3.2.15-0.36.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 8 Fedora Update System 2009-10-03 18:59:24 UTC 
samba-3.4.2-0.42.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 9 errata-xmlrpc 2009-10-27 17:12:03 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5

Via RHSA-2009:1529 https://rhn.redhat.com/errata/RHSA-2009-1529.html
Comment 10 errata-xmlrpc 2009-11-16 15:40:03 UTC 
This issue has been addressed in following products:

  Extras for Red Hat Enterprise Linux 5

Via RHSA-2009:1585 https://rhn.redhat.com/errata/RHSA-2009-1585.html
Note You need to log in before you can comment on or make changes to this bug.