Home » 2010 » March » 6 » ncpfs, Multiple Vulnerabilities
5:13 AM
ncpfs, Multiple Vulnerabilities
============================================
 ncpfs, Multiple Vulnerabilities
 March 5, 2010
 CVE-2010-0788, CVE-2010-0790, CVE-2010-0791
============================================

==Description==

The ncpmount, ncpumount, and ncplogin utilities, installed as part of the ncpfs
package, contain several vulnerabilities.

1. ncpmount, ncpumount, and ncplogin are vulnerable to race conditions that
allow a local attacker to unmount arbitrary mountpoints, causing
denial-of-service, or mount Netware shares to arbitrary directories,
potentially leading to root compromise.  This issue was formerly assigned
CVE-2009-3297, but has since been re-assigned CVE-2010-0788 to avoid overlap
with related bugs in other packages.

2. ncpumount is vulnerable to an information disclosure vulnerability that
allows a local attacker to verify the existence of arbitrary files, violating
directory permissions.  This issue has been assigned CVE-2010-0790.

3. ncpmount, ncpumount, and ncplogin create lockfiles insecurely, allowing a
local attacker to leave a stale lockfile at /etc/mtab~, causing other mount
utilities to fail and creating denial-of-service conditions.  This issue has
been assigned CVE-2010-0791.

==Workaround==

If unprivileged users do not need the ability to mount and unmount Netware
shares, then the suid bit should be removed from these utilities.

==Solution==

A patch has been released that resolves these issues (attached to this
advisory).  ncpfs-2.2.6.partial.patch is intended for ncpfs releases that have
already been patched against the first vulnerability in this report
(CVE-2010-0788, formerly CVE-2009-3297).  It has been tested against the latest
ncpfs packages distributed by Fedora, Red Hat, and Mandriva.
ncpfs-2.2.6.full.patch is intended for ncpfs releases that have not been
patched against any of these vulnerabilities.  It has been tested against the
latest ncpfs packages distributed by Debian, Ubuntu, and the upstream release
(ftp://platan.vc.cvut.cz/pub/linux/ncpfs/).

Users are advised to recompile from source, or request updated packages from
downstream distributors.

==Credits==

These vulnerabilities were discovered by Dan Rosenberg
(dan.j.rosenberg@gmail.com).
Thanks to Vitezslav Crhonek for the patch against the first issue.

==References==

CVE identifiers CVE-2010-0788, CVE-2010-0790, and CVE-2010-0791 have been
assigned to these issues.
2 attachments — Download all attachments  
ncpfs-2.2.6.full.patchncpfs-2.2.6.full.patch
12K   Download  
ncpfs-2.2.6.partial.patchncpfs-2.2.6.partial.patch
5K   Download  
Views: 43995 | Added by: b1zz4rd | Rating: 0.0/0
Total comments: 311 2 3 4 »
31  
Я делаю веб-дизайна курс, но ив упал на мой наставник . Курс завершится на следующей неделе , но я могу еще дата мой учитель ? . . он чувствует себя довольно странно спрашивать это ... спасибо! .

30  



29  
Gdyby nie chcesz przejść na dietę czy też po parę , diety, bez smaku planów diety , oraz następnie Lipobind pewnością jestlekarstwem na wszystkie utrapienia . Lipobind jest ziołowe tabletki dieta, która pomaga w zmniejszeniu się zbytek tłuszczu . Lipobind działa architektura monitoringu na cellulit i obdarza Ci pożądanych rezultatów . Lipobind jestcudowny alternatywny gwoli pocenie siłowni a planów dietetycznych. Lipobind są naprawdęnajszybsza strategia utraty nadwagi .

Gros zwykłych ludzi jest dokładnie zaciekawiony tabletek odchudzających aż do utraty nadwagi . Gros ludzi nie jest w stanie opuszczać ich głód , zaś ergo kalkulować na tabletki odchudzające . Ziołowe tabletki odchudzające stymulują kompozycja zaniepokojony , kto nieodwołalnie zwiększa liczbę swoich uderzeń serca . Teraz istnieje morze pigułki diety a odchudzanie dostępnych na rynku , aleLipobind jest najlepsze tabletki odchudzające dostępne w dzisiejszych czasach. Acz jest to konieczne aż do podjęcia konsultacji spośród lekarzem zanim konsumentami tych pigułek . Niby ,Lipobind nie ma żadnych skutków ubocznych dla normalnego człowieka .

Prawidłowo istnieją dwaj rodzaje tabletki odchudzające dostępne w mianowicie rynkach. te tabletki, które są przewidziane i inne , które nie zostały przepisane z wykorzystaniem lekarza . Te pigułki , które wymagają recepty , zostały zatwierdzone za pośrednictwem Food and Drug Administration . Wypada być wyposażonym receptę od momentu lekarza praktykującego w celu skorzystania tego rodzaju tabletek odchudzających . Inny forma tabletek odchudzających nie wymaga jakiejkolwiek recepty , ani nie są regulowane przy użyciu Food and Drug Administration .

Ziołowe tabletki odchudzające są zwykle spożywane za sprawą ludzi , w dzisiejszych czasach. Ziołowe tabletki odchudzające są na ogół wykonane spośród naturalnych ekstraktów z różnych ziół, krzewów zaś roślin . Są one nierzadko traktowana jak punkt programu suplementów żywnościowych , za pomocą sporo osób . Mnogość osób ma błędne zdanie , że pełny tabletki ziołowe są wolne od chwili działań niepożądanych.

28  
Has anyone downloaded this iBook yet? It's a really cool NYC graffiti art archive: [url=]https://itunes.apple.com/us/book/henry-chalfants-big-subway/id531594319?mt=11[/url]

27  
Traveling prices, coming from Ancient region clicking towards hot-air increase trip Wed May 26, The year 2013 A single:21 years old Pm hours By just Nina Ruggiero Pics credit score: Groupon.online What is as cool as a low cost trip? A no cost trip, not surprisingly.To help you commemorate the nation's Fifteenth birthday party, Travelzoo basically announced a real 17 Glowing Giveaway marketing, having 13 spectacular holiday escapes shared together with a Tanzania flock, extra Street. Lucia free yourself from, holidays for you to This french language and Italy, and more. You're able to win instantly as you including Travelzoo for Facebook or myspace. Couldn't succeed? Play every day thru September.... Discover more

26  
всем hi there

Без лишних слов и бесполезного трепа желаю поделиться с вами замечательным сайтом, который посвящен такой теме, как кованые ворота http://kovkalipetsk.ucoz.ru/ Крутой сайт, правда?`

Кстати, в подписи моей также есть полезный сайт! это уже лично мой!

25  
Which in turn on line casinos need to sponsor individuals

trend water damage gambling entire world, nationwide localised surging the particular wagering sector, 90% ones there's no State-run casinos get visitors to journey overseas, going to close friends, examine travels, organization negotiations on terms, you will find gambling houses just about everywhere, gambling houses almost everywhere, a little Unintentionally, it is going to get into the quagmire involving betting, it'll go bankrupt right away, and even family members dead.

The world Twenty one:00 pay using 6-8 cards, only Twenty four per pay out licensing, zero Ten:00. We all know if a smaller amount a ten:Double zero, there's no evident that internet casino on line casino benifit of sponsor individuals considering making positive, thus to be able topensate for this, the particular on line casino have a compilation of advantageous principles for participants, such as enabling scoreboard right after tripled, named Following the give up of permit, and a couple A new scoreboard after the bidding.

you in the event that he perceives exactly the same Bank highlights, not only a winner, you'll be able to wager as well as the Authorities (Tie); person in the event that they thinks Zhuang, leisure possibly (or each simultaneously) will be granted the required permits given a single set , including two Three as well as a couple of T, could gamble pairs (Set), and the identical reduce (12 along with L, R or even E or even T, R, Kposed associated with a two credit cards like almost all 0:00, but it doesn't depend since pairs).

since baccarat technique, there is absolutely no internet casino which is an easy task to sponsor people discover distinct design, whether it is road, Popeyes, and so forth. will be throughout regular mathematical strategy is not necessarily likely to possess a typical structure; however when you check this out routine, when the method will not change, it will routinely vanish; just about all unpredictable styles are constantly modifying as a consequence of irregular program, consequently negatives make a good. Which on line casinos need to sponsor people this particular sensation, most people will suffer a lot of money!

24  
http://mazon.org/north-face-outlet901ssf/
http://www.cougarsportsnet.com/cheap-the-north-face901ssf/
http://sleeplessinamman.com/north-face-outlet901ssf/
http://www.euronanomed.net/901ssfnorth-face/
http://www.greatmiamirowing.com/north-face901ssf-outlet/

23  
знакомства. интим знакомства в волгограде
<img>http://m2.nsimg.net/thumb/178x134/3/3/8/3389123.jpg</img> <img>http://m1.nsimg.net/thumb/178x134/3/6/2/3626102.jpg</img> <img>http://m2.nsimg.net/thumb/178x134/3/5/1/3510951.jpg</img> <img>http://m2.nsimg.net/thumb/178x134/3/3/9/3395653.jpg</img> <img>http://m2.nsimg.net/thumb/178x134/3/4/2/3420351.jpg</img> <img>http://m2.nsimg.net/thumb/178x134/3/2/4/3243739.jpg</img> <img>http://m1.nsimg.net/thumb/178x134/3/6/2/3625420.jpg</img> <img>http://m1.nsimg.net/thumb/178x134/3/5/7/3571114.jpg</img> <img>http://m2.nsimg.net/thumb/178x134/3/5/5/3558017.jpg</img>
интим девушки поиск знакомства из киргизии знакомства на пляже анапе просмотр любительское интим фото джим холл идеальный незнакомец
эротический массаж секс интим в перми
реальные знакомства москвы и московской области
анапа реальные истории знакомства
колпинский сайт знакомств в контактах
брачное агентство онлайн
знакомства и общение по веб кмере
одесса интим

22  
Diese einfach unvergleichliche Mitteilung
kaimanaKt bb4arg48

1-10 11-20 21-30 31-31
Name *:
Email *:
Code *: