cve/2010/CVE-2010-0296.md

CVE-2010-0296

Description

The encode_name macro in misc/mntent_r.c in the GNU C Library (aka glibc or libc6) 2.11.1 and earlier, as used by ncpmount and mount.cifs, does not properly handle newline characters in mountpoint names, which allows local users to cause a denial of service (mtab corruption), or possibly modify mount options and gain privileges, via a crafted mount request.

POC

Reference

• http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html
• http://seclists.org/fulldisclosure/2019/Jun/18
• http://www.vmware.com/security/advisories/VMSA-2011-0012.html
• https://seclists.org/bugtraq/2019/Jun/14

Github

• https://github.com/auditt7708/rhsecapi