Vulnerabilities > CVE-2016-1572 - Improper Privilege Management vulnerability in multiple products

047910
CVSS 4.6 - MEDIUM
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL

Summary

mount.ecryptfs_private.c in eCryptfs-utils does not validate mount destination filesystem types, which allows local users to gain privileges by mounting over a nonstandard filesystem, as demonstrated by /proc/$pid.

Vulnerable Configurations

Part Description Count
Application
Ecryptfs
47
OS
Canonical
4
OS
Opensuse
3
OS
Debian
2
OS
Fedoraproject
2

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Restful Privilege Elevation
    Rest uses standard HTTP (Get, Put, Delete) style permissions methods, but these are not necessarily correlated generally with back end programs. Strict interpretation of HTTP get methods means that these HTTP Get services should not be used to delete information on the server, but there is no access control mechanism to back up this logic. This means that unless the services are properly ACL'd and the application's service implementation are following these guidelines then an HTTP request can easily execute a delete or update on the server side. The attacker identifies a HTTP Get URL such as http://victimsite/updateOrder, which calls out to a program to update orders on a database or other resource. The URL is not idempotent so the request can be submitted multiple times by the attacker, additionally, the attacker may be able to exploit the URL published as a Get method that actually performs updates (instead of merely retrieving data). This may result in malicious or inadvertent altering of data on the server.

Nessus

  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-397.NASL
    descriptionJann Horn discovered that the setuid-root mount.ecryptfs_private helper in the ecryptfs-utils would mount over any target directory that the user owns, including a directory in procfs. A local attacker could use this flaw to escalate his privileges. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2016-01-21
    plugin id88023
    published2016-01-21
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/88023
    titleDebian DLA-397-1 : ecryptfs-utils security update
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Debian Security Advisory DLA-397-1. The text
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(88023);
      script_version("2.10");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");
    
      script_cve_id("CVE-2016-1572");
    
      script_name(english:"Debian DLA-397-1 : ecryptfs-utils security update");
      script_summary(english:"Checks dpkg output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Jann Horn discovered that the setuid-root mount.ecryptfs_private
    helper in the ecryptfs-utils would mount over any target directory
    that the user owns, including a directory in procfs. A local attacker
    could use this flaw to escalate his privileges.
    
    NOTE: Tenable Network Security has extracted the preceding description
    block directly from the DLA security advisory. Tenable has attempted
    to automatically clean and format it as much as possible without
    introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://lists.debian.org/debian-lts-announce/2016/01/msg00022.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/squeeze-lts/ecryptfs-utils"
      );
      script_set_attribute(attribute:"solution", value:"Upgrade the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:ecryptfs-utils");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:ecryptfs-utils-dbg");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libecryptfs-dev");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libecryptfs0");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:6.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2016/01/20");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/01/21");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"6.0", prefix:"ecryptfs-utils", reference:"83-4+squeeze2")) flag++;
    if (deb_check(release:"6.0", prefix:"ecryptfs-utils-dbg", reference:"83-4+squeeze2")) flag++;
    if (deb_check(release:"6.0", prefix:"libecryptfs-dev", reference:"83-4+squeeze2")) flag++;
    if (deb_check(release:"6.0", prefix:"libecryptfs0", reference:"83-4+squeeze2")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-119.NASL
    descriptionThis update for ecryptfs-utils fixes the following issues : - CVE-2016-1572: A local user could have escalated privileges by mounting over special filesystems (bsc#962052) - CVE-2014-9687: A default salt value reduced complexity of offline precomputation attacks (bsc#920160) This update was imported from the SUSE:SLE-12:Update update project.
    last seen2020-06-05
    modified2016-02-03
    plugin id88544
    published2016-02-03
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/88544
    titleopenSUSE Security Update : ecryptfs-utils (openSUSE-2016-119)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-0290-1.NASL
    descriptionThis update for ecryptfs-utils fixes the following issues : - CVE-2016-1572: A local user could have escalated privileges by mounting over special filesystems (bsc#962052) - CVE-2014-9687: A default salt value reduced complexity of offline precomputation attacks (bsc#920160) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id88508
    published2016-02-01
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/88508
    titleSUSE SLED11 / SLES11 Security Update : ecryptfs-utils (SUSE-SU-2016:0290-1)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2016-B02AD4E424.NASL
    description - manpage ecryptfs-migrate-home.8: Fix typos - clang static analysis fixes - Refuse to mount over non-standard filesystems. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2016-03-04
    plugin id89595
    published2016-03-04
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/89595
    titleFedora 23 : ecryptfs-utils-109-1.fc23 (2016-b02ad4e424)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-93.NASL
    descriptionThis update for ecryptfs-utils fixes the following issues : - CVE-2016-1572: A local user could have escalated privileges by mounting over special filesystems (bsc#962052)
    last seen2020-06-05
    modified2016-01-26
    plugin id88166
    published2016-01-26
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/88166
    titleopenSUSE Security Update : ecryptfs-utils (openSUSE-2016-93)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-0241-1.NASL
    descriptionThis update for ecryptfs-utils fixes the following issues : - CVE-2016-1572: A local user could have escalated privileges by mounting over special filesystems (bsc#962052) - CVE-2014-9687: A default salt value reduced complexity of offline precomputation attacks (bsc#920160) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id88408
    published2016-01-27
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/88408
    titleSUSE SLED12 / SLES12 Security Update : ecryptfs-utils (SUSE-SU-2016:0241-1)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2016-7B9A2FE987.NASL
    description - manpage ecryptfs-migrate-home.8: Fix typos - clang static analysis fixes - Refuse to mount over non-standard filesystems. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2016-03-04
    plugin id89568
    published2016-03-04
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/89568
    titleFedora 22 : ecryptfs-utils-109-1.fc22 (2016-7b9a2fe987)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3450.NASL
    descriptionJann Horn discovered that the setuid-root mount.ecryptfs_private helper in the ecryptfs-utils would mount over any target directory that the user owns, including a directory in procfs. A local attacker could use this flaw to escalate his privileges.
    last seen2020-06-01
    modified2020-06-02
    plugin id88024
    published2016-01-21
    reporterThis script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/88024
    titleDebian DSA-3450-1 : ecryptfs-utils - security update
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-125.NASL
    descriptionThis update for ecryptfs-utils fixes the following issues : - CVE-2016-1572: A local user could have escalated privileges by mounting over special filesystems (bsc#962052)
    last seen2020-06-05
    modified2016-02-03
    plugin id88546
    published2016-02-03
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/88546
    titleopenSUSE Security Update : ecryptfs-utils (openSUSE-2016-125)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-2876-1.NASL
    descriptionJann Horn discovered that mount.ecryptfs_private would mount over certain directories in the proc filesystem. A local attacker could use this to escalate their privileges. (CVE-2016-1572). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id88040
    published2016-01-21
    reporterUbuntu Security Notice (C) 2016-2019 Canonical, Inc. / NASL script (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/88040
    titleUbuntu 12.04 LTS / 14.04 LTS / 15.04 / 15.10 : ecryptfs-utils vulnerability (USN-2876-1)