CVE-2011-1089
The addmntent function in the GNU C Library (aka glibc or libc6) 2.13 and earlier does not report an error status for failed attempts to wri
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The addmntent function in the GNU C Library (aka glibc or libc6) 2.13 and earlier does not report an error status for failed attempts to write to the /etc/mtab file, which makes it easier for local users to trigger corruption of this file, as demonstrated by writes from a process with a small RLIMIT_FSIZE value, a different vulnerability than CVE-2010-0296.
Timeline
- CVE published
- Record last updated
Affected versions
- n/a n/a
Version range not reported
References 22
openwall.com
- lists/oss-security/2011/03/14/5
- lists/oss-security/2011/03/04/9
- lists/oss-security/2011/03/22/6
- lists/oss-security/2011/03/22/4
- lists/oss-security/2011/03/05/7
- lists/oss-security/2011/03/07/9
- lists/oss-security/2011/04/01/2
- lists/oss-security/2011/03/04/10
- lists/oss-security/2011/03/14/16
- lists/oss-security/2011/03/31/4
- lists/oss-security/2011/03/04/12
- lists/oss-security/2011/03/14/7
- lists/oss-security/2011/03/04/11
- lists/oss-security/2011/03/05/3
- lists/oss-security/2011/03/31/3
- lists/oss-security/2011/03/15/6