FUSE Local Information Disclosure Vulnerability
BID:13857
Info
FUSE Local Information Disclosure Vulnerability
| Bugtraq ID: | 13857 |
| Class: | Design Error |
| CVE: |
CVE-2005-1858 |
| Remote: | No |
| Local: | Yes |
| Published: | Jun 06 2005 12:00AM |
| Updated: | Jul 12 2009 02:56PM |
| Credit: | Sven Tantau <[email protected]> is credited with the discovery of this vulnerability. |
| Vulnerable: |
Miklos Szeredi FUSE 2.3 -rc1 Miklos Szeredi FUSE 2.2.1 Miklos Szeredi FUSE 2.2 |
| Not Vulnerable: |
Miklos Szeredi FUSE 2.3 .0 |
Discussion
FUSE Local Information Disclosure Vulnerability
FUSE is susceptible to a local information disclosure vulnerability. This issue is due to a failure of the kernel module to properly clear used memory prior to its reuse.
This vulnerability allows malicious local users to gain access to potentially sensitive kernel memory, aiding them in further attacks.
FUSE versions 2.2, 2.2.1, 2.3-pre*, and 2.3-rc1, running on Linux kernel versions 2.4, through 2.6 are affected by this issue.
FUSE is susceptible to a local information disclosure vulnerability. This issue is due to a failure of the kernel module to properly clear used memory prior to its reuse.
This vulnerability allows malicious local users to gain access to potentially sensitive kernel memory, aiding them in further attacks.
FUSE versions 2.2, 2.2.1, 2.3-pre*, and 2.3-rc1, running on Linux kernel versions 2.4, through 2.6 are affected by this issue.
Exploit / POC
FUSE Local Information Disclosure Vulnerability
A proof of concept exploit is available:
A proof of concept exploit is available:
Solution / Fix
FUSE Local Information Disclosure Vulnerability
Solution:
The vendor has released version 2.3.0 of FUSE to resolve this issue.
Debian has released advisory DSA 744-1 to address this issue. Please see the referenced advisory for more information.
Debian has released security advisory DSA 773-1 addressing several issues for their AMD64 port of the operating system. Please see the referenced advisory for further information.
Miklos Szeredi FUSE 2.2
Miklos Szeredi FUSE 2.2.1
Solution:
The vendor has released version 2.3.0 of FUSE to resolve this issue.
Debian has released advisory DSA 744-1 to address this issue. Please see the referenced advisory for more information.
Debian has released security advisory DSA 773-1 addressing several issues for their AMD64 port of the operating system. Please see the referenced advisory for further information.
Miklos Szeredi FUSE 2.2
-
Miklos Szeredi fuse-2.3.0.tar.gz
http://prdownloads.sourceforge.net/fuse/fuse-2.3.0.tar.gz?download
Miklos Szeredi FUSE 2.2.1
-
Debian fuse-source_2.2.1-4sarge2_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/fuse-source_2.2.1- 4sarge2_all.deb -
Debian fuse-utils_2.2.1-4sarge2_alpha.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/fuse-utils_2.2.1-4 sarge2_alpha.deb -
Debian fuse-utils_2.2.1-4sarge2_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/fuse-utils_2.2.1-4 sarge2_amd64.deb -
Debian fuse-utils_2.2.1-4sarge2_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/fuse-utils_2.2.1-4 sarge2_arm.deb -
Debian fuse-utils_2.2.1-4sarge2_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/fuse-utils_2.2.1-4 sarge2_hppa.deb -
Debian fuse-utils_2.2.1-4sarge2_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/fuse-utils_2.2.1-4 sarge2_i386.deb -
Debian fuse-utils_2.2.1-4sarge2_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/fuse-utils_2.2.1-4 sarge2_ia64.deb -
Debian fuse-utils_2.2.1-4sarge2_m68k.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/fuse-utils_2.2.1-4 sarge2_m68k.deb -
Debian fuse-utils_2.2.1-4sarge2_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/fuse-utils_2.2.1-4 sarge2_mips.deb -
Debian fuse-utils_2.2.1-4sarge2_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/fuse-utils_2.2.1-4 sarge2_mipsel.deb -
Debian fuse-utils_2.2.1-4sarge2_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/fuse-utils_2.2.1-4 sarge2_powerpc.deb -
Debian fuse-utils_2.2.1-4sarge2_s390.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/fuse-utils_2.2.1-4 sarge2_s390.deb -
Debian fuse-utils_2.2.1-4sarge2_sparc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/fuse-utils_2.2.1-4 sarge2_sparc.deb -
Debian libfuse-dev_2.2.1-4sarge2_alpha.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/libfuse-dev_2.2.1- 4sarge2_alpha.deb -
Debian libfuse-dev_2.2.1-4sarge2_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/libfuse-dev_2.2.1- 4sarge2_amd64.deb -
Debian libfuse-dev_2.2.1-4sarge2_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/libfuse-dev_2.2.1- 4sarge2_arm.deb -
Debian libfuse-dev_2.2.1-4sarge2_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/libfuse-dev_2.2.1- 4sarge2_hppa.deb -
Debian libfuse-dev_2.2.1-4sarge2_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/libfuse-dev_2.2.1- 4sarge2_i386.deb -
Debian libfuse-dev_2.2.1-4sarge2_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/libfuse-dev_2.2.1- 4sarge2_ia64.deb -
Debian libfuse-dev_2.2.1-4sarge2_m68k.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/libfuse-dev_2.2.1- 4sarge2_m68k.deb -
Debian libfuse-dev_2.2.1-4sarge2_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/libfuse-dev_2.2.1- 4sarge2_mips.deb -
Debian libfuse-dev_2.2.1-4sarge2_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/libfuse-dev_2.2.1- 4sarge2_mipsel.deb -
Debian libfuse-dev_2.2.1-4sarge2_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/libfuse-dev_2.2.1- 4sarge2_powerpc.deb -
Debian libfuse-dev_2.2.1-4sarge2_s390.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/libfuse-dev_2.2.1- 4sarge2_s390.deb -
Debian libfuse-dev_2.2.1-4sarge2_sparc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/libfuse-dev_2.2.1- 4sarge2_sparc.deb -
Debian libfuse2_2.2.1-4sarge2_alpha.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/libfuse2_2.2.1-4sa rge2_alpha.deb -
Debian libfuse2_2.2.1-4sarge2_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/libfuse2_2.2.1-4sa rge2_amd64.deb -
Debian libfuse2_2.2.1-4sarge2_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/libfuse2_2.2.1-4sa rge2_arm.deb -
Debian libfuse2_2.2.1-4sarge2_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/libfuse2_2.2.1-4sa rge2_hppa.deb -
Debian libfuse2_2.2.1-4sarge2_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/libfuse2_2.2.1-4sa rge2_i386.deb -
Debian libfuse2_2.2.1-4sarge2_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/libfuse2_2.2.1-4sa rge2_ia64.deb -
Debian libfuse2_2.2.1-4sarge2_m68k.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/libfuse2_2.2.1-4sa rge2_m68k.deb -
Debian libfuse2_2.2.1-4sarge2_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/libfuse2_2.2.1-4sa rge2_mips.deb -
Debian libfuse2_2.2.1-4sarge2_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/libfuse2_2.2.1-4sa rge2_mipsel.deb -
Debian libfuse2_2.2.1-4sarge2_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/libfuse2_2.2.1-4sa rge2_powerpc.deb -
Debian libfuse2_2.2.1-4sarge2_s390.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/libfuse2_2.2.1-4sa rge2_s390.deb -
Debian libfuse2_2.2.1-4sarge2_sparc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/f/fuse/libfuse2_2.2.1-4sa rge2_sparc.deb -
Miklos Szeredi fuse-2.3.0.tar.gz
http://prdownloads.sourceforge.net/fuse/fuse-2.3.0.tar.gz?download
References
FUSE Local Information Disclosure Vulnerability
References:
References:
- FUSE Home Page (Miklos Szeredi)
- FUSE: Filesystem in Userspace - Information Disclosure (Sven Tantau
- Release Name: 2.3.0 (Miklos Szeredi)