Debian: New afuse packages fix privilege escalation


 
Thread Tools Search this Thread
Special Forums Cybersecurity Security Advisories (RSS) Debian: New afuse packages fix privilege escalation
# 1  
Old 07-16-2008
Debian: New afuse packages fix privilege escalation

LinuxSecurity.com: Anders Kaseorg discovered that afuse, an automounting file system in user-space, did not properly escape meta characters in paths. This allowed a local attacker with read access to the filesystem to execute commands as the owner of the filesystem.

More...
Login or Register to Ask a Question

Previous Thread | Next Thread
Login or Register to Ask a Question
AFUSE(1)						      General Commands Manual							  AFUSE(1)

NAME
AFUSE - automounting file system implemented in user-space using FUSE DESCRIPTION
usage: afuse mountpoint [options] general options: -o opt,[opt...] mount options -h --help print help -V --version print FUSE version information AFUSE options: -o mount_template=CMD template for CMD to execute to mount (*) -o unmount_template=CMD template for CMD to execute to unmount (*) (**) (*) - When executed, %r and %m are expanded in templates to the root directory name for the new mount point, and the actual directory to mount onto respectively to mount onto. Both templates are REQUIRED. (**)- The unmount command must perform a lazy unmount operation. E.g. the -u -z options to fusermount, or -l for regular mount. FUSE options: -d -o debug enable debug output (implies -f) -f foreground operation -s disable multi-threaded operation -o allow_other allow access to other users -o allow_root allow access to root -o nonempty allow mounts over non-empty file/dir -o default_permissions enable permission checking by kernel -o fsname=NAME set filesystem name -o large_read issue large read requests (2.4 only) -o max_read=N set maximum size of read requests -o hard_remove immediate removal (don't hide files) -o use_ino let filesystem set inode numbers -o readdir_ino try to fill in d_ino in readdir -o direct_io use direct I/O -o kernel_cache cache files in kernel -o umask=M set file permissions (octal) -o uid=N set file owner -o gid=N set file group -o entry_timeout=T cache timeout for names (1.0s) -o negative_timeout=T cache timeout for deleted names (0.0s) -o attr_timeout=T cache timeout for attributes (1.0s) AUTHOR
This manual page was written by Varun Hiremath <varunhiremath@gmail.com>, for the Debian project (but may be used by others). October 12, 2006 AFUSE(1)