Professional OVAL Repository

Id oval:org.mitre.oval:def:9953

Version 30

Class vulnerability

ALTXid 1636

Language English

Severity NotAvailable

Title The CIFS filesystem in the Linux kernel before 2.6.22, when Unix extension support is enabled, does not honor the umask of a process, which allows local users to gain privileges. Description The CIFS filesystem in the Linux kernel before 2.6.22, when Unix extension support is enabled, does not honor the umask of a process, which allows local users to gain privileges.

Platform Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5

• Status: ACCEPTED
  Status: ACCEPTED
  
  

  • 2010-07-09T03:56:16-04:00 : submitted
    • SCAP.com, LLC Aharon Chernin
  • 2010-07-28T14:19:36.571-04:00 : status_change DRAFT
  • 2010-08-16T04:15:08.852-04:00 : status_change INTERIM
  • 2010-09-06T04:16:17.310-04:00 : status_change ACCEPTED
  • 2013-04-10T17:36:00.135-04:00 : modified EDITED oval:org.mitre.oval:def:9953 - Expanded the vulnerability checks for RHEL 3, 4, and 5 to cover CentOS 3, 4, 5 and Oracle Linux 4 and 5
    • G2, Inc. Dragos Prisaca
  • 2013-04-10T17:40:12.405-04:00 : status_change INTERIM
  • 2013-04-29T04:23:36.089-04:00 : status_change ACCEPTED

• CVE: CVE-2007-3740
  CVE: CVE-2007-3740
  Id: CVE-2007-3740

  Reference: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3740

  
  

  Comment : The CIFS filesystem in the Linux kernel before 2.6.22, when Unix extension support is enabled, does not honor the umask of a process, which allows local users to gain privileges.

  
  

  CVSSv2 Score: 4.4

  Access vector:	PARTIAL
  Access complexity:	MEDIUM
  Authentication:	NONE
  Confidentiality impact:	PARTIAL
  Integrity impact:	PARTIAL
  Availability impact:	PARTIAL

  
  CVSSv2 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P
  

  
  
  

  CWE: 264 (Permissions, Privileges, and Access Controls)

  
  References:

  • SUSE-SA:2007:064 (SUSE)
  • SUSE-SA:2008:006 (SUSE)
  • 26760 (SECUNIA)
  • 26955 (SECUNIA)
  • 26978 (SECUNIA)
  • 27436 (SECUNIA)
  • 27747 (SECUNIA)
  • 27912 (SECUNIA)
  • 28806 (SECUNIA)
  • 29058 (SECUNIA)
  • http://support.avaya.com/elmodocs2/security/ASA-2007-474.htm (CONFIRM)
  • DSA-1378 (DEBIAN)
  • DSA-1504 (DEBIAN)
  • http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22 (CONFIRM)
  • MDVSA-2008:008 (MANDRIVA)
  • MDVSA-2008:105 (MANDRIVA)
  • RHSA-2007:0705 (REDHAT)
  • RHSA-2007:0939 (REDHAT)
  • 25672 (BID)
  • USN-518-1 (UBUNTU)
  • https://bugzilla.redhat.com/show_bug.cgi?id=253314 (MISC)
  • kernel-cifs-filesystem-dos(36593) (XF)
  • oval:org.mitre.oval:def:9953 (OVAL)

Expand All

Collapse All