CVE - CVE-2011-2724

CVE-ID
CVE-2011-2724	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The check_mtab function in client/mount.cifs.c in mount.cifs in smbfs in Samba 3.5.10 and earlier does not properly verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which allows local users to cause a denial of service (mtab corruption) via a crafted string. NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-0547.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:1025984 URL:http://www.securitytracker.com/id?1025984 MISC:45798 URL:http://secunia.com/advisories/45798 MISC:MDVSA-2011:148 URL:~~http://www.mandriva.com/security/advisories?name=MDVSA-2011:148~~ (Obsolete source) MISC:RHSA-2011:1220 URL:http://www.redhat.com/support/errata/RHSA-2011-1220.html MISC:RHSA-2011:1221 URL:http://www.redhat.com/support/errata/RHSA-2011-1221.html MISC:[oss-security] 20110729 CVE-2011-2724 assignment notification -- samba -- incomplete fix for CVE-2010-0547 issue URL:http://openwall.com/lists/oss-security/2011/07/29/9 MISC:http://comments.gmane.org/gmane.linux.kernel.cifs/3827 URL:http://comments.gmane.org/gmane.linux.kernel.cifs/3827 MISC:http://git.samba.org/?p=cifs-utils.git%3Ba=commit%3Bh=1e7a32924b22d1f786b6f490ce8590656f578f91 URL:http://git.samba.org/?p=cifs-utils.git%3Ba=commit%3Bh=1e7a32924b22d1f786b6f490ce8590656f578f91 MISC:https://bugzilla.redhat.com/show_bug.cgi?id=726691 URL:https://bugzilla.redhat.com/show_bug.cgi?id=726691
Assigning CNA
Red Hat, Inc.
Date Record Created
20110711	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20110711)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)