CVE-2011-1011 The seunshare_mount function in sandbox/seunshare.c in seunshare in certain Red Hat packages of policycoreutils 2.0.83 and earlier in Red Hat Enterprise Linux (RHEL) 6 and earlier, and Fedora 14 and e...
MediumCVSS 6.9
EPSS 0.37%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The seunshare_mount function in sandbox/seunshare.c in seunshare in certain Red Hat packages of policycoreutils 2.0.83 and earlier in Red Hat Enterprise Linux (RHEL) 6 and earlier, and Fedora 14 and earlier, mounts a new directory on top of /tmp without assigning root ownership and the sticky bit to this new directory, which allows local users to replace or delete arbitrary /tmp files, and consequently cause a denial of service or possibly gain privileges, by running a setuid application that relies on /tmp, as demonstrated by the ksu application.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat policycoreutils | <= 2.0.83 | No fix listed |
| redhat policycoreutils | = 1.0 | No fix listed |
| redhat policycoreutils | = 1.1 | No fix listed |
| redhat policycoreutils | = 1.2 | No fix listed |
| redhat policycoreutils | = 1.4 | No fix listed |
| redhat policycoreutils | = 1.6 | No fix listed |
| redhat policycoreutils | = 1.8 | No fix listed |
| redhat policycoreutils | = 1.10 | No fix listed |
| redhat policycoreutils | = 1.12 | No fix listed |
| redhat policycoreutils | = 1.14 | No fix listed |
| redhat policycoreutils | = 1.16 | No fix listed |
| redhat policycoreutils | = 1.18 | No fix listed |
| redhat policycoreutils | = 1.20 | No fix listed |
| redhat policycoreutils | = 1.21.1 | No fix listed |
| redhat policycoreutils | = 1.21.2 | No fix listed |
| redhat policycoreutils | = 1.21.3 | No fix listed |
| redhat policycoreutils | = 1.21.4 | No fix listed |
| redhat policycoreutils | = 1.21.5 | No fix listed |
| redhat policycoreutils | = 1.21.6 | No fix listed |
| redhat policycoreutils | = 1.21.7 | No fix listed |
| redhat policycoreutils | = 1.21.8 | No fix listed |
| redhat policycoreutils | = 1.21.9 | No fix listed |
| redhat policycoreutils | = 1.21.10 | No fix listed |
| redhat policycoreutils | = 1.21.11 | No fix listed |
| redhat policycoreutils | = 1.21.12 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat policycoreutils | = 1.21.13 | No fix listed |
| redhat policycoreutils | = 1.21.14 | No fix listed |
| redhat policycoreutils | = 1.21.15 | No fix listed |
| redhat policycoreutils | = 1.21.16 | No fix listed |
| redhat policycoreutils | = 1.21.17 | No fix listed |
| redhat policycoreutils | = 1.21.18 | No fix listed |
| redhat policycoreutils | = 1.21.19 | No fix listed |
| redhat policycoreutils | = 1.21.20 | No fix listed |
| redhat policycoreutils | = 1.21.21 | No fix listed |
| redhat policycoreutils | = 1.21.22 | No fix listed |
| redhat policycoreutils | = 1.22 | No fix listed |
| redhat policycoreutils | = 1.23.1 | No fix listed |
| redhat policycoreutils | = 1.23.2 | No fix listed |
| redhat policycoreutils | = 1.23.3 | No fix listed |
| redhat policycoreutils | = 1.23.4 | No fix listed |
| redhat policycoreutils | = 1.23.5 | No fix listed |
| redhat policycoreutils | = 1.23.6 | No fix listed |
| redhat policycoreutils | = 1.23.7 | No fix listed |
| redhat policycoreutils | = 1.23.8 | No fix listed |
| redhat policycoreutils | = 1.23.9 | No fix listed |
| redhat policycoreutils | = 1.23.10 | No fix listed |
| redhat policycoreutils | = 1.23.11 | No fix listed |
| redhat policycoreutils | = 1.24 | No fix listed |
| redhat policycoreutils | = 1.25.1 | No fix listed |
| redhat policycoreutils | = 1.25.2 | No fix listed |
| redhat policycoreutils | = 1.25.3 | No fix listed |
| redhat policycoreutils | = 1.25.4 | No fix listed |
| redhat policycoreutils | = 1.25.5 | No fix listed |
| redhat policycoreutils | = 1.25.6 | No fix listed |
| redhat policycoreutils | = 1.25.7 | No fix listed |
| redhat policycoreutils | = 1.25.8 | No fix listed |
| redhat policycoreutils | = 1.25.9 | No fix listed |
| redhat policycoreutils | = 1.26 | No fix listed |
| redhat policycoreutils | = 1.27.1 | No fix listed |
| redhat policycoreutils | = 1.27.2 | No fix listed |
| redhat policycoreutils | = 1.27.3 | No fix listed |
| redhat policycoreutils | = 1.27.4 | No fix listed |
| redhat policycoreutils | = 1.27.5 | No fix listed |
| redhat policycoreutils | = 1.27.6 | No fix listed |
| redhat policycoreutils | = 1.27.7 | No fix listed |
| redhat policycoreutils | = 1.27.8 | No fix listed |
| redhat policycoreutils | = 1.27.9 | No fix listed |
| redhat policycoreutils | = 1.27.10 | No fix listed |
| redhat policycoreutils | = 1.27.11 | No fix listed |
| redhat policycoreutils | = 1.27.12 | No fix listed |
| redhat policycoreutils | = 1.27.13 | No fix listed |
| redhat policycoreutils | = 1.27.14 | No fix listed |
| redhat policycoreutils | = 1.27.15 | No fix listed |
| redhat policycoreutils | = 1.27.16 | No fix listed |
| redhat policycoreutils | = 1.27.17 | No fix listed |
| redhat policycoreutils | = 1.27.18 | No fix listed |
| redhat policycoreutils | = 1.27.19 | No fix listed |
| redhat policycoreutils | = 1.27.20 | No fix listed |
| redhat policycoreutils | = 1.27.21 | No fix listed |
| redhat policycoreutils | = 1.27.22 | No fix listed |
| redhat policycoreutils | = 1.27.23 | No fix listed |
| redhat policycoreutils | = 1.27.24 | No fix listed |
| redhat policycoreutils | = 1.27.25 | No fix listed |
| redhat policycoreutils | = 1.27.26 | No fix listed |
| redhat policycoreutils | = 1.27.27 | No fix listed |
| redhat policycoreutils | = 1.27.28 | No fix listed |
| redhat policycoreutils | = 1.27.29 | No fix listed |
| redhat policycoreutils | = 1.27.30 | No fix listed |
| redhat policycoreutils | = 1.27.31 | No fix listed |
| redhat policycoreutils | = 1.27.32 | No fix listed |
| redhat policycoreutils | = 1.27.33 | No fix listed |
| redhat policycoreutils | = 1.27.34 | No fix listed |
| redhat policycoreutils | = 1.27.35 | No fix listed |
| redhat policycoreutils | = 1.27.36 | No fix listed |
| redhat policycoreutils | = 1.27.37 | No fix listed |
| redhat policycoreutils | = 1.28 | No fix listed |
| redhat policycoreutils | = 1.29.1 | No fix listed |
| redhat policycoreutils | = 1.29.2 | No fix listed |
| redhat policycoreutils | = 1.29.3 | No fix listed |
| redhat policycoreutils | = 1.29.4 | No fix listed |
| redhat policycoreutils | = 1.29.5 | No fix listed |
| redhat policycoreutils | = 1.29.6 | No fix listed |
| redhat policycoreutils | = 1.29.7 | No fix listed |
| redhat policycoreutils | = 1.29.8 | No fix listed |
| redhat policycoreutils | = 1.29.9 | No fix listed |
| redhat policycoreutils | = 1.29.10 | No fix listed |
| redhat policycoreutils | = 1.29.11 | No fix listed |
| redhat policycoreutils | = 1.29.12 | No fix listed |
| redhat policycoreutils | = 1.29.13 | No fix listed |
| redhat policycoreutils | = 1.29.14 | No fix listed |
| redhat policycoreutils | = 1.29.15 | No fix listed |
| redhat policycoreutils | = 1.29.16 | No fix listed |
| redhat policycoreutils | = 1.29.17 | No fix listed |
| redhat policycoreutils | = 1.29.18 | No fix listed |
| redhat policycoreutils | = 1.29.19 | No fix listed |
| redhat policycoreutils | = 1.29.20 | No fix listed |
| redhat policycoreutils | = 1.29.21 | No fix listed |
| redhat policycoreutils | = 1.29.22 | No fix listed |
| redhat policycoreutils | = 1.29.23 | No fix listed |
| redhat policycoreutils | = 1.29.24 | No fix listed |
| redhat policycoreutils | = 1.29.25 | No fix listed |
| redhat policycoreutils | = 1.29.26 | No fix listed |
| redhat policycoreutils | = 1.29.27 | No fix listed |
| redhat policycoreutils | = 1.29.28 | No fix listed |
| redhat policycoreutils | = 1.30 | No fix listed |
| redhat policycoreutils | = 1.30.1 | No fix listed |
| redhat policycoreutils | = 1.30.2 | No fix listed |
| redhat policycoreutils | = 1.30.3 | No fix listed |
| redhat policycoreutils | = 1.30.4 | No fix listed |
| redhat policycoreutils | = 1.30.5 | No fix listed |
| redhat policycoreutils | = 1.30.6 | No fix listed |
| redhat policycoreutils | = 1.30.7 | No fix listed |
| redhat policycoreutils | = 1.30.8 | No fix listed |
| redhat policycoreutils | = 1.30.9 | No fix listed |
| redhat policycoreutils | = 1.30.10 | No fix listed |
| redhat policycoreutils | = 1.30.11 | No fix listed |
| redhat policycoreutils | = 1.30.12 | No fix listed |
| redhat policycoreutils | = 1.30.13 | No fix listed |
| redhat policycoreutils | = 1.30.14 | No fix listed |
| redhat policycoreutils | = 1.30.15 | No fix listed |
| redhat policycoreutils | = 1.30.16 | No fix listed |
| redhat policycoreutils | = 1.30.17 | No fix listed |
| redhat policycoreutils | = 1.30.18 | No fix listed |
| redhat policycoreutils | = 1.30.19 | No fix listed |
| redhat policycoreutils | = 1.30.20 | No fix listed |
| redhat policycoreutils | = 1.30.21 | No fix listed |
| redhat policycoreutils | = 1.30.22 | No fix listed |
| redhat policycoreutils | = 1.30.23 | No fix listed |
| redhat policycoreutils | = 1.30.24 | No fix listed |
| redhat policycoreutils | = 1.30.25 | No fix listed |
| redhat policycoreutils | = 1.30.26 | No fix listed |
| redhat policycoreutils | = 1.30.27 | No fix listed |
| redhat policycoreutils | = 1.30.28 | No fix listed |
| redhat policycoreutils | = 1.30.29 | No fix listed |
| redhat policycoreutils | = 1.30.30 | No fix listed |
| redhat policycoreutils | = 1.30.31 | No fix listed |
| redhat policycoreutils | = 1.32 | No fix listed |
| redhat policycoreutils | = 1.33.1 | No fix listed |
| redhat policycoreutils | = 1.33.2 | No fix listed |
| redhat policycoreutils | = 1.33.3 | No fix listed |
| redhat policycoreutils | = 1.33.4 | No fix listed |
| redhat policycoreutils | = 1.33.5 | No fix listed |
| redhat policycoreutils | = 1.33.6 | No fix listed |
| redhat policycoreutils | = 1.33.7 | No fix listed |
| redhat policycoreutils | = 1.33.8 | No fix listed |
| redhat policycoreutils | = 1.33.9 | No fix listed |
| redhat policycoreutils | = 1.33.10 | No fix listed |
| redhat policycoreutils | = 1.33.11 | No fix listed |
| redhat policycoreutils | = 1.33.12 | No fix listed |
| redhat policycoreutils | = 1.33.13 | No fix listed |
| redhat policycoreutils | = 1.33.14 | No fix listed |
| redhat policycoreutils | = 1.33.15 | No fix listed |
| redhat policycoreutils | = 1.33.16 | No fix listed |
| redhat policycoreutils | = 1.34.0 | No fix listed |
| redhat policycoreutils | = 1.34.1 | No fix listed |
| redhat policycoreutils | = 2.0.0 | No fix listed |
| redhat policycoreutils | = 2.0.1 | No fix listed |
| redhat policycoreutils | = 2.0.2 | No fix listed |
| redhat policycoreutils | = 2.0.3 | No fix listed |
| redhat policycoreutils | = 2.0.4 | No fix listed |
| redhat policycoreutils | = 2.0.5 | No fix listed |
| redhat policycoreutils | = 2.0.6 | No fix listed |
| redhat policycoreutils | = 2.0.7 | No fix listed |
| redhat policycoreutils | = 2.0.8 | No fix listed |
| redhat policycoreutils | = 2.0.9 | No fix listed |
| redhat policycoreutils | = 2.0.10 | No fix listed |
| redhat policycoreutils | = 2.0.11 | No fix listed |
| redhat policycoreutils | = 2.0.12 | No fix listed |
| redhat policycoreutils | = 2.0.13 | No fix listed |
| redhat policycoreutils | = 2.0.14 | No fix listed |
| redhat policycoreutils | = 2.0.15 | No fix listed |
| redhat policycoreutils | = 2.0.16 | No fix listed |
| redhat policycoreutils | = 2.0.17 | No fix listed |
| redhat policycoreutils | = 2.0.18 | No fix listed |
| redhat policycoreutils | = 2.0.19 | No fix listed |
| redhat policycoreutils | = 2.0.20 | No fix listed |
| redhat policycoreutils | = 2.0.21 | No fix listed |
| redhat policycoreutils | = 2.0.22 | No fix listed |
| redhat policycoreutils | = 2.0.23 | No fix listed |
| redhat policycoreutils | = 2.0.24 | No fix listed |
References
- 20110222 Developers should not rely on the stickiness of /tmp on Red Hat Linux mailing-list
- FEDORA-2011-3043 vendor-advisory
- [oss-security] 20110222 CVE Request mailing-list
- [oss-security] 20110223 Re: CVE Request mailing-list
- pkgs.fedoraproject.org
- 43415 third-party-advisory vendor-advisory
- 43844 third-party-advisory
- 44034 third-party-advisory
- RHSA-2011:0414 vendor-advisory
- 46510 vdb-entry
- 1025291 vdb-entry
- ADV-2011-0701 vdb-entry
- ADV-2011-0864 vdb-entry
- bugzilla.redhat.com patch
- policycoreutils-seunshare-symlink(65641) vdb-entry