Veracode Vulnerability DatabaseVERACODE:13098Access Control Bypass
EPSS
Percentile
48.8%
libfuse.so is vulnerable to an access control bypass. A local non-root user is able to mount the FUSE file system with allow_other option regardless of the user_allow_other fuse configuration. An attacker can trick other users into accessing a malicious FUSE mount point and cause a denial of service condition.
References
access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.6_release_notes/index
access.redhat.com/errata/RHSA-2018:3324
access.redhat.com/security/updates/classification/#moderate
bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10906
lists.debian.org/debian-lts-announce/2018/08/msg00015.html
lists.fedoraproject.org/archives/list/[email protected]/message/5XYA6PXT5PPWVK7CM7K4YRCYWA37DODB/
lists.fedoraproject.org/archives/list/[email protected]/message/A253TZWZK6R7PT2S5JIEAQJR2TYKX7V2/
lists.fedoraproject.org/archives/list/[email protected]/message/BREAIWIK64DRJWHIGR47L2D5YICY4HQ3/
www.debian.org/security/2018/dsa-4257
www.exploit-db.com/exploits/45106/
Related
