EulerOS Virtualization 2.5.3 : fuse (EulerOS-SA-2019-1186)

According to the version of the fuse packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - A vulnerability was discovered in fuse. When SELinux is active, fusermount is vulnerable to a restriction bypass. This allows non-root...

Fedora 29 : fuse (2019-31722b8f33)

Update fuse to 2.9.9, fuse3 to 3.4.2. Also fixes CVE-2018-10906, and adds missing fusermount.1 man page. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as...

The vulnerability of the fusermount module in file system drivers for UNIX-like operating systems allows a attacker to cause a service failure or other unpredictable behavior.

The vulnerability of the fusermount driver for file systems in UNIX-like operating systems relates to circumventing a limitation under SELinux’s mandatory access control policy. This allows users without root privileges to mount the FUSE file system with the “allowother” mount option, regardless ...

openSUSE: Security Advisory for fuse (openSUSE-SU-2018:3326-1)

The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE Security Update : fuse (openSUSE-2018-1225)

This update for fuse fixes the following security issue : - CVE-2018-10906: fusermount was vulnerable to a restriction bypass when SELinux is active. This allowed non-root users to mount a FUSE file system with the 'allowother' mount option regardless of whether 'userallowother' is set in the fus...

Keybase: Linux privilege escalation via trusted $PATH in keybase-redirector

keybase-redirector is a setuid root binary. keybase-redirector calls the fusermount binary using a relative path and the application trusts the value of $PATH. This allows a local, unprivileged user to trick the application to executing a custom fusermount binary as root. Environment CentOS Linux...

fusermount - user_allow_other Restriction Bypass and SELinux Label Control

/ It is possible to bypass fusermount's restrictions on the use of the "allowother" mount option as follows if SELinux is active. Here's a minimal demo, tested on a Debian system with SELinux enabled in permissive mode: =============================================== uuser@debian:$ mount|grep...

fusermount - user_allow_other Restriction Bypass and SELinux Label Control Exploit

Exploit for linux platform in category dos / poc / It is possible to bypass fusermount's restrictions on the use of the "allowother" mount option as follows if SELinux is active. Here's a minimal demo, tested on a Debian system with SELinux enabled in permissive mode:...

fusermount Restriction Bypass

fusermount userallowother restriction bypass and SELinux label control CVE-2018-10906 It is possible to bypass fusermount's restrictions on the use of the "allowother" mount option as follows if SELinux is active. Here's a minimal demo, tested on a Debian system with SELinux enabled in permissive...

fusermount - user_allow_other Restriction Bypass and SELinux Label Control

fusermount - userallowother Restriction Bypass and SELinux Label Control / It is possible to bypass fusermount's restrictions on the use of the "allowother" mount option as follows if SELinux is active. Here's a minimal demo, tested on a Debian system with SELinux enabled in permissive mode:...

[SECURITY] [DSA 4257-1] fuse security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4257-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 28, 2018 https://www.debian.org/security/faq -...

CVE-2018-10906

In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to mount a FUSE file system with the 'allowother' mount option regardless of whether 'userallowother' is set in the fuse configuration. An attack...

Gentoo Security Advisory GLSA 201603-04

Gentoo Linux Local Security Checks GLSA 201603-04 SPDX-FileCopyrightText: 2016 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

Amazon Linux: Security Advisory (ALAS-2015-558)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Medium: fuse

Issue Overview: It was discovered that fusermount failed to properly sanitize its environment before executing mount and umount commands. A local user could possibly use this flaw to escalate their privileges on the system. Affected Packages: fuse Issue Correction: Run yum update fuse or yum upda...

DEBIAN-CVE-2015-3202

fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking 1 mount or 2 umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNTMTAB environment variable that is used by mount's debugging feature...

Design/Logic Flaw

fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking 1 mount or 2 umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNTMTAB environment variable that is used by mount's debugging feature...

CVE-2015-3202

CVE-2015-3202 affects FUSE’s fusermount prior to 2.9.3-15, where environment variables are not fully cleared before invoking mount or umount as root. This allows a local unprivileged user to write to arbitrary files via a crafted LIBMOUNT_MTAB used by mount’s debugging feature, potentially enabli...

CVE-2015-3202

fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking 1 mount or 2 umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNTMTAB environment variable that is used by mount's debugging feature...

CVE-2015-3202

fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking 1 mount or 2 umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNTMTAB environment variable that is used by mount's debugging feature...