Vulnerability Details : CVE-2010-3879
FUSE, possibly 2.8.5 and earlier, allows local users to create mtab entries with arbitrary pathnames, and consequently unmount any filesystem, via a symlink attack on the parent directory of the mountpoint of a FUSE filesystem, a different vulnerability than CVE-2010-0789.
Exploit prediction scoring system (EPSS) score for CVE-2010-3879
Probability of exploitation activity in the next 30 days: 0.07%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 28 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2010-3879
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
5.8
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:P |
8.6
|
4.9
|
NIST |
CWE ids for CVE-2010-3879
-
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.Assigned by: nvd@nist.gov (Primary)
References for CVE-2010-3879
-
http://www.ubuntu.com/usn/USN-1045-1
USN-1045-1: FUSE vulnerability | Ubuntu security noticesThird Party Advisory
-
http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053792.html
[SECURITY] Fedora 14 Update: util-linux-ng-2.18-4.8.fc14Third Party Advisory
-
http://www.vupen.com/english/advisories/2011/0302
Webmail | OVH- OVHPermissions Required
-
http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html
[security-announce] SUSE Security Summary Report: SUSE-SR:2011:005Third Party Advisory
-
https://bugs.launchpad.net/bugs/670622
Bug #670622 “fusermount allows unmount any filesystem” : Bugs : fuse package : UbuntuExploit;Third Party Advisory
-
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=602333
#602333 - /usr/bin/fusermount: fusermount allows unmount any filesystem - Debian Bug report logsExploit;Patch;Third Party Advisory
-
http://openwall.com/lists/oss-security/2010/11/04/8
oss-security - CVE request: fuseExploit;Mailing List;Third Party Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/62986
FUSE fusermount tool denial of service CVE-2010-3879 Vulnerability ReportThird Party Advisory;VDB Entry
-
https://bugzilla.novell.com/show_bug.cgi?id=651598
Bug 651598 – VUL-1: fuse umount raceExploit;Issue Tracking
-
http://www.halfdog.net/Security/FuseTimerace/
Unmount Any Filesystem Using fusermountExploit;Patch;Third Party Advisory
-
http://openwall.com/lists/oss-security/2010/11/05/2
oss-security - Re: CVE request: fuseExploit;Mailing List;Third Party Advisory
-
http://lists.grok.org.uk/pipermail/full-disclosure/2010-November/077247.html
[Full-Disclosure] Mailing List CharterExploit;Third Party Advisory
-
http://www.securityfocus.com/bid/44623
FUSE fusermount Tool Race Condition VulnerabilityExploit;Third Party Advisory;VDB Entry
-
https://bugzilla.redhat.com/show_bug.cgi?id=651183
651183 – (CVE-2010-3879, CVE-2011-0541, CVE-2011-0542, CVE-2011-0543) CVE-2010-3879 CVE-2011-0541 CVE-2011-0542 CVE-2011-0543 fuse: unprivileged user can unmount arbitrary locations via symlink attackExploit;Issue Tracking;Patch
-
http://www.ubuntu.com/usn/USN-1045-2
USN-1045-2: util-linux update | Ubuntu security noticesThird Party Advisory
-
http://www.vupen.com/english/advisories/2011/0181
Webmail | OVH- OVHPermissions Required
-
http://www.mandriva.com/security/advisories?name=MDVSA-2013:155
mandriva.comThird Party Advisory
Products affected by CVE-2010-3879
- cpe:2.3:a:libfuse_project:libfuse:*:*:*:*:*:*:*:*