ncpfs Multiple Local Vulnerabilities

Bugtraq ID:	38563
Class:	Unknown
CVE:	CVE-2010-0788 CVE-2010-0790 CVE-2010-0791
Remote:	No
Local:	Yes
Published:	Mar 05 2010 12:00AM
Updated:	Jun 15 2010 05:29PM
Credit:	Dan Rosenberg
Vulnerable:	SuSE SUSE Linux Enterprise 11 SP1 SuSE SUSE Linux Enterprise 11 SuSE SUSE Linux Enterprise 10 SP3 SuSE SUSE Linux Enterprise 10 SP2 SuSE SUSE Linux Enterprise 10 S.u.S.E. openSUSE 11.2 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 ncpfs ncpfs 2.2.5 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 + Gentoo Linux ncpfs ncpfs 2.2.4 + Conectiva Linux Enterprise Edition 1.0 + S.u.S.E. Linux Connectivity Server + S.u.S.E. Linux Database Server 0 + S.u.S.E. Linux Personal 9.2 + S.u.S.E. Linux Personal 9.1 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 + S.u.S.E. Linux Personal 8.2 + SuSE Linux 8.1 + SuSE Linux 8.0 + SuSE Linux Desktop 1.0 + SuSE Linux Enterprise Server 9 + SuSE SUSE Linux Enterprise Server 8 ncpfs ncpfs 2.2.3 ncpfs ncpfs 2.2.2 ncpfs ncpfs 2.2.1 ncpfs ncpfs 2.2 .18 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 ncpfs ncpfs 2.2 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 Mandriva Linux Mandrake 2010.0 x86_64 Mandriva Linux Mandrake 2010.0 Mandriva Linux Mandrake 2009.1 x86_64 Mandriva Linux Mandrake 2009.1 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 MandrakeSoft Multi Network Firewall 2.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 4.0
Not Vulnerable:	ncpfs ncpfs 2.2.6 + MandrakeSoft Corporate Server 3.0 x86_64 + MandrakeSoft Corporate Server 3.0 x86_64 + MandrakeSoft Corporate Server 3.0 + MandrakeSoft Corporate Server 3.0 + Mandriva Linux Mandrake 10.1 x86_64 + Mandriva Linux Mandrake 10.1 + Mandriva Linux Mandrake 10.1 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 + Mandriva Linux Mandrake 10.0

ncpfs Multiple Local Vulnerabilities

ncpfs is prone to multiple local vulnerabilities:

- A local privilege-escalation vulnerability.
- A local information-disclosure vulnerability.
- A denial-of-service condition.

Local attackers can exploit these issues to execute arbitrary commands with elevated privileges, crash the affected computer, and gain access to sensitive information.

ncpfs Multiple Local Vulnerabilities

To exploit these issues, an attacker can use readily available command-line utilities.

ncpfs Multiple Local Vulnerabilities

Solution:
Updates are available. Please see the references for more information.


Mandriva Linux Mandrake 2010.0 x86_64

• Mandriva ipxutils-2.2.6-7.2mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64ncpfs-devel-2.2.6-7.2mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64ncpfs2.3-2.2.6-7.2mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva ncpfs-2.2.6-7.2mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2009.1 x86_64

• Mandriva ipxutils-2.2.6-7.2mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64ncpfs-devel-2.2.6-7.2mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64ncpfs2.3-2.2.6-7.2mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva ncpfs-2.2.6-7.2mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2009.0

• Mandriva ipxutils-2.2.6-6.2mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libncpfs-devel-2.2.6-6.2mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libncpfs2.3-2.2.6-6.2mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva ncpfs-2.2.6-6.2mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Enterprise Server 5 x86_64

• Mandriva ipxutils-2.2.6-6.2mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64ncpfs-devel-2.2.6-6.2mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64ncpfs2.3-2.2.6-6.2mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva ncpfs-2.2.6-6.2mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Corporate Server 4.0

• Mandriva ipxutils-2.2.6-1.2.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libncpfs2.3-2.2.6-1.2.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libncpfs2.3-devel-2.2.6-1.2.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva ncpfs-2.2.6-1.2.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva ipxutils-2.2.6-6.2mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64ncpfs-devel-2.2.6-6.2mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64ncpfs2.3-2.2.6-6.2mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva ncpfs-2.2.6-6.2mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2008.0 x86_64

• Mandriva ipxutils-2.2.6-3.2mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64ncpfs2.3-2.2.6-3.2mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64ncpfs2.3-devel-2.2.6-3.2mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva ncpfs-2.2.6-3.2mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Enterprise Server 5

• Mandriva ipxutils-2.2.6-6.2mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libncpfs-devel-2.2.6-6.2mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libncpfs2.3-2.2.6-6.2mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva ncpfs-2.2.6-6.2mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2008.0

• Mandriva ipxutils-2.2.6-3.2mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libncpfs2.3-2.2.6-3.2mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libncpfs2.3-devel-2.2.6-3.2mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva ncpfs-2.2.6-3.2mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2009.1

• Mandriva ipxutils-2.2.6-7.2mdv2009.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libncpfs-devel-2.2.6-7.2mdv2009.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libncpfs2.3-2.2.6-7.2mdv2009.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva ncpfs-2.2.6-7.2mdv2009.1.i586.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2010.0

• Mandriva ipxutils-2.2.6-7.2mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libncpfs-devel-2.2.6-7.2mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libncpfs2.3-2.2.6-7.2mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva ncpfs-2.2.6-7.2mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Multi Network Firewall 2.0

• Mandriva ipxutils-2.2.6-0.3.M20mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libncpfs2.3-2.2.6-0.3.M20mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libncpfs2.3-devel-2.2.6-0.3.M20mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva ncpfs-2.2.6-0.3.M20mdk.i586.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Corporate Server 4.0 x86_64

• Mandriva ipxutils-2.2.6-1.2.20060mlcs4.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64ncpfs2.3-2.2.6-1.2.20060mlcs4.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64ncpfs2.3-devel-2.2.6-1.2.20060mlcs4.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva ncpfs-2.2.6-1.2.20060mlcs4.x86_64.rpm
  http://www.mandriva.com/en/download/

ncpfs Multiple Local Vulnerabilities

References:

• ncpfs Homepage (ncfps)
  
• ncpfs, Multiple Vulnerabilities (Dan Rosenburg)