SB2014051805 - Gentoo update for util-linux

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Resource management error (CVE-ID: CVE-2011-1675)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

mount in util-linux 2.19 and earlier attempts to append to the /etc/mtab.tmp file without first checking whether resource limits would interfere, which allows local users to trigger corruption of the /etc/mtab file via a process with a small RLIMIT_FSIZE value, a related issue to CVE-2011-1089.

2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2011-1676)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

mount in util-linux 2.19 and earlier does not remove the /etc/mtab.tmp file after a failed attempt to add a mount entry, which allows local users to trigger corruption of the /etc/mtab file via multiple invocations.

3) Input validation error (CVE-ID: CVE-2011-1677)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

mount in util-linux 2.19 and earlier does not remove the /etc/mtab~ lock file after a failed attempt to add a mount entry, which has unspecified impact and local attack vectors.

4) Information disclosure (CVE-ID: CVE-2013-0157)

The vulnerability allows a local non-authenticated attacker to gain access to sensitive information.

(a) mount and (b) umount in util-linux 2.14.1, 2.17.2, and probably other versions allow local users to determine the existence of restricted directories by (1) using the --guess-fstype command-line option or (2) attempting to mount a non-existent device, which generates different error messages depending on whether the directory exists.

Remediation

Install update from vendor's website.

References

• https://security.gentoo.org/
• https://security.gentoo.org/glsa/201405-15