National Vulnerability Database

National Vulnerability Database

National Vulnerability
Database

CVE-2010-1088 Detail

Description

fs/namei.c in Linux kernel 2.6.18 through 2.6.34 does not always follow NFS automount "symlinks," which allows attackers to have an unknown impact, related to LOOKUP_FOLLOW.

Source:  MITRE      Last Modified:  04/06/2010

Quick Info

CVE Dictionary Entry:
CVE-2010-1088
Original release date:
04/06/2010
Last revised:
09/18/2017
Source:
US-CERT/NIST

Impact

CVSS Severity (version 2.0):
CVSS v2 Base Score:
5.4 MEDIUM
Vector:
(AV:N/AC:H/Au:N/C:N/I:N/A:C) (legend)
Impact Subscore:
6.9
Exploitability Subscore:
4.9
CVSS Version 2 Metrics:
Access Vector:
Network exploitable
Access Complexity:
High
Authentication:
Not required to exploit
Impact Type:
Allows disruption of service

Vendor Statements (disclaimer)

Official Statement from Red Hat (04/07/2010)

Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/CVE-2010-1088 This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 3 and 4 as this issue only affects kernel version 2.6.18 and onwards. A future update in Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG may address this flaw.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink Resource Type Source Name
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=ac278a9c505092dd82077a2446af8f9fc0d9c095 Exploit; Patch External Source CONFIRM http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=ac278a9c505092dd82077a2446af8f9fc0d9c095
http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00007.html External Source SUSE SUSE-SA:2010:019
http://www.debian.org/security/2010/dsa-2053 External Source DEBIAN DSA-2053
http://www.mandriva.com/security/advisories?name=MDVSA-2010:088 External Source MANDRIVA MDVSA-2010:088
http://www.mandriva.com/security/advisories?name=MDVSA-2010:198 External Source MANDRIVA MDVSA-2010:198
http://www.novell.com/linux/security/advisories/2010_23_kernel.html External Source SUSE SUSE-SA:2010:023
http://www.openwall.com/lists/oss-security/2010/02/24/3 Patch External Source MLIST [oss-security] 20100224 CVE request: kernel: NFS DoS related to "automount" symlinks
http://www.securityfocus.com/archive/1/archive/1/516397/100/0/threaded External Source BUGTRAQ 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
http://www.securityfocus.com/bid/39044 External Source BID 39044
http://www.vmware.com/security/advisories/VMSA-2011-0003.html External Source CONFIRM http://www.vmware.com/security/advisories/VMSA-2011-0003.html
https://bugzilla.redhat.com/show_bug.cgi?id=567813 Patch External Source CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=567813
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10093 External Source OVAL oval:org.mitre.oval:def:10093

References to Check Content

Identifier:
oval:org.mitre.oval:def:10093
Check System:
http://oval.mitre.org/XMLSchema/oval-definitions-5
Hyperlink:
http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:10093

Technical Details

Vulnerability Type (View All)

Vulnerable software and versions Switch to CPE 2.2

Configuration 1
OR
cpe:2.3:o:linux:linux_kernel:2.6.18:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.18.1:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.18.2:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.18.3:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.18.4:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.18.5:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.18.6:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.18.7:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.18.8:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.19:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.19.1:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.19.2:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.19.3:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.19.4:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.19.5:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.19.6:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.19.7:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.20:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.20.1:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.20.2:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.20.3:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.20.4:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.20.5:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.20.6:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.20.7:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.20.8:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.20.9:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.20.10:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.20.11:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.20.12:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.20.13:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.20.14:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.20.15:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.20.16:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.20.17:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.20.18:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.20.19:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.20.20:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.20.21:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.21:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.21.1:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.21.2:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.21.3:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.21.4:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.21.5:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.21.6:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.21.7:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.22:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.22.1:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.22.2:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.22.3:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.22.4:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.22.5:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.22.6:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.22.7:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.22.8:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.22.9:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.22.10:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.22.11:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.22.12:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.22.13:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.22.14:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.22.15:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.22.16:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.22.17:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.22.18:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.22.19:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.23:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.23.1:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.23.2:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.23.3:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.23.4:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.23.5:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.23.6:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.23.7:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.23.8:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.23.9:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.23.10:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.23.11:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.23.12:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.23.13:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.23.14:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.23.15:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.23.16:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.23.17:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.24:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.24:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.24:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.24:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.24:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.24:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.24.1:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.24.2:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.24.3:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.24.4:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.24.5:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.24.6:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.24.7:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.25:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.25.1:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.25.2:*:*:*:*:*:*:*
Showing 100 of 252 CPEs, view all CPEs here.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History 2 change records found - show changes