CVE-2010-2524 in Kernel
Summary
The DNS resolution functionality in the CIFS implementation in the Linux kernel before 2.6.35, when CONFIG_CIFS_DFS_UPCALL is enabled, relies on a user s keyring for the dns_resolver upcall in the cifs.upcall userspace helper, which allows local users to spoof the results of DNS queries and perform arbitrary CIFS mounts via vectors involving an add_key call, related to a "cache stuffing" issue and MS-DFS referrals.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Reservation
06/30/2010
Disclosure
09/08/2010
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 54638 | Linux Kernel authentication spoofing | 290 | Not defined | Official fix | CVE-2010-2524 |