The Linux kernel before 2.6.23-rc1 checks the wrong global variable for the CIFS sec mount option, which might allow remote attackers to spoof CIFS network traffic that the client configured for security signatures, as demonstrated by lack of signing despite sec=ntlmv2i in a SetupAndX request.
CVSS Details
- CVSS 3.1 Base Score: 9.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Oracle_linux | — | Upgrade kernel | Oct 16, 2024 | Aug 9, 2007 |
| Suse | — | Upgrade kernel-rtUpgrade suse-releaseUpgrade kernel-xenpaeUpgrade kernel-defaultUpgrade kernel-kdumpUpgrade kernel-rt_debugUpgrade kernel-debugUpgrade kernel-bigsmpUpgrade kernel-sourceUpgrade kernel-iseries64Upgrade kernel-xenUpgrade kernel-ppc64Upgrade kernel-syms | Feb 17, 2015 | Aug 9, 2007 |
| Ubuntu | — | Upgrade linux-image-2.6.20-16-lowlatencyUpgrade linux-image-2.6.20-16-hppa32Upgrade linux-image-2.6.20-16-powerpc-smpUpgrade linux-image-2.6.20-16-powerpcUpgrade linux-image-2.6.20-16-serverUpgrade linux-image-2.6.20-16-mckinleyUpgrade linux-image-2.6.20-16-genericUpgrade linux-image-2.6.20-16-powerpc64-smpUpgrade linux-image-2.6.20-16-server-bigironUpgrade linux-image-2.6.20-16-sparc64Upgrade linux-image-2.6.20-16-itaniumUpgrade linux-image-2.6.20-16-386Upgrade linux-image-2.6.20-16-hppa64Upgrade linux-image-2.6.20-16-sparc64-smp | Nov 8, 2024 | Aug 9, 2007 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub