NVD

Id
13983  
Name
CVE-2010-2524  
Description
The DNS resolution functionality in the CIFS implementation in the Linux kernel before 2.6.35, when CONFIG_CIFS_DFS_UPCALL is enabled, relies on a user"s keyring for the dns_resolver upcall in the cifs.upcall userspace helper, which allows local users to spoof the results of DNS queries and perform arbitrary CIFS mounts via vectors involving an add_key call, related to a "cache stuffing" issue and MS-DFS referrals.  
Reject
 
CVSS Version
2  
CVSS Score
4.4  
Severity
Medium  
CVSS Base Score
4.4  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2010-09-08  
Modified Date
2012-03-19  
Seq
2010-2524  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
77430 13983 CVE-2010-2524 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4c0c03ca54f72fdd5912516ad0a23ec5cf01bda7  View
77431 13983 CVE-2010-2524 SUSE-SA:2010:040  View
77432 13983 CVE-2010-2524 [oss-security] 20100802 CVE-2010-2524 kernel: dns_resolver upcall security issue  View
77433 13983 CVE-2010-2524 [oss-security] 20100802 Re: CVE-2010-2524 kernel: dns_resolver upcall security issue  View
77434 13983 CVE-2010-2524 [oss-security] 20100803 Re: CVE-2010-2524 kernel: dns_resolver upcall security issue  View
77435 13983 CVE-2010-2524 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.35  View
77436 13983 CVE-2010-2524 MDVSA-2010:172  View
77437 13983 CVE-2010-2524 RHSA-2010:0610  View
77438 13983 CVE-2010-2524 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX  View
77439 13983 CVE-2010-2524 USN-1000-1  View
77440 13983 CVE-2010-2524 http://www.vmware.com/security/advisories/VMSA-2011-0003.html  View
77441 13983 CVE-2010-2524 https://bugzilla.redhat.com/show_bug.cgi?id=612166  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
36226 JVNDB-2010-002006 Linux kernel の DNS resolution 機能における任意の CIFS マウントを実行される脆弱性 Linux kernel の CIFS 実装内にある DNS resolution 機能には、CONFIG_CIFS_DFS_UPCALL が有効な際、cifs.upcall ユーザースペースヘルパーの dns_resolver upcall のユーザのキーリングに依存するため、DNS クエリの結果を改ざんされ、任意の CIFS マウントを実行される脆弱性が存在します。 CVE-2010-2524 45104 CVE-2010-2524 13983 4.4 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-002006.html 2010-08-01 2011-03-03 View