NetSight
IP …
low3.6Public exploit code

CVE-2015-3202

fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write t…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.

Affected products

VendorProductAffected versions
DebianDebian Linux
Version 8.0
Fuse ProjectFuse
through 2.9.2

Weakness classification

CWE-264

References