Ubuntu.comUB:CVE-2011-3191CVE-2011-3191
8.8 High
CVSS3
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
8.3 High
CVSS2
Access Vector
ADJACENT_NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:A/AC:L/Au:N/C:C/I:C/A:C
0.002 Low
EPSS
Percentile
56.0%
Integer signedness error in the CIFSFindNext function in fs/cifs/cifssmb.c
in the Linux kernel before 3.1 allows remote CIFS servers to cause a denial
of service (memory corruption) or possibly have unspecified other impact
via a large length value in a response to a read request for a directory.
Bugs
Notes
| Author | Note |
|---|---|
| apw | patch title is as below in CIFS tree, likely SHA1 added below: cifs: fix possible memory corruption in CIFSFindNext |
| kees | actual sha is below, old one from CIFS tree was c32dfffaf59f73bbcf4472141b851a4dc5db2bf0 |
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 8.04 | noarch | linux | < 2.6.24-29.94 | UNKNOWN |
| ubuntu | 10.04 | noarch | linux | < 2.6.32-35.78 | UNKNOWN |
| ubuntu | 10.10 | noarch | linux | < 2.6.35-30.60 | UNKNOWN |
| ubuntu | 11.04 | noarch | linux | < 2.6.38-12.51 | UNKNOWN |
| ubuntu | 10.04 | noarch | linux-ec2 | < 2.6.32-319.39 | UNKNOWN |
| ubuntu | 10.04 | noarch | linux-fsl-imx51 | < 2.6.31-611.29 | UNKNOWN |
| ubuntu | 10.04 | noarch | linux-lts-backport-maverick | < 2.6.35-30.60~lucid1 | UNKNOWN |
| ubuntu | 10.04 | noarch | linux-lts-backport-natty | < 2.6.38-12.51~lucid1 | UNKNOWN |
| ubuntu | 10.04 | noarch | linux-mvl-dove | < 2.6.32-219.37 | UNKNOWN |
| ubuntu | 10.10 | noarch | linux-mvl-dove | < 2.6.32-419.37 | UNKNOWN |
References
www.openwall.com/lists/oss-security/2011/08/24/2
launchpad.net/bugs/cve/CVE-2011-3191
nvd.nist.gov/vuln/detail/CVE-2011-3191
security-tracker.debian.org/tracker/CVE-2011-3191
ubuntu.com/security/notices/USN-1219-1
ubuntu.com/security/notices/USN-1220-1
ubuntu.com/security/notices/USN-1225-1
ubuntu.com/security/notices/USN-1227-1
ubuntu.com/security/notices/USN-1228-1
ubuntu.com/security/notices/USN-1239-1
ubuntu.com/security/notices/USN-1240-1
ubuntu.com/security/notices/USN-1241-1
ubuntu.com/security/notices/USN-1245-1
ubuntu.com/security/notices/USN-1246-1
ubuntu.com/security/notices/USN-1253-1
ubuntu.com/security/notices/USN-1256-1
www.cve.org/CVERecord?id=CVE-2011-3191
Related
8.8 High
CVSS3
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
8.3 High
CVSS2
Access Vector
ADJACENT_NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:A/AC:L/Au:N/C:C/I:C/A:C
0.002 Low
EPSS
Percentile
56.0%