Security bugs are reported here via bugzilla

[Thomas HOUSSIN <thomas.houssin AT gmail.com>]

Synopsis
========
When unmounting a filesystem with the '-r' option, the file system is
remounted with the MS_RDONLY ("ro") flag alone, thus clearing all its
other flags, including nosuid and nodev.

Background
==========
Util-linux is a suite of essential utilities for any Linux system. Its
primary audience is system integrators and DIY Linux hackers.
Util-linux is attempting to be portable, but the only platform it has
been tested much on is Linux i386.

Description
===========
CAN-2005-2876:
umount in util-linux 2.8 to 2.12q, 2.13-pre1, and 2.13-pre2 allows
local users with unmount permissions to gain privileges via the -r
(remount) option, which causes the file system to be remounted with
just the read-only flag, which effectively clears the nosuid, nodev,
and other flags.

Impact
======
An unprivileged user can use this vulnerability to all flags except
'ro', allowing applications to be executed suid, or have device nodes
interpreted. If the user can freely write on the filesystem, privilege
escalation may occur (for example by creating und running a custom
program with suid permissions).

Workaround
==========
Removing the setuid bit from umount is a first workaround. Another is
to edit /etc/fstab to restrict user from mounting and unmounting
filesystems.

Affected packages
=================
util-linux in all grimoires is affected. This is now fixed in devel,
test, stable-rc/0.2 and stable/0.1 grimoires.

Resolution
==========
All util-linux users should upgrade to the latest available version:
       # scribe update
       # cast -c util-linux

References
==========
 [ 1 ] CAN-2005-2876
       http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2005-2876
 [ 2 ] unintentional grant of privileges by umount
       http://www.securityfocus.com/archive/1/410333

-- 
Thomas Houssin

Security Team Leader Source Mage GNU/Linux (http://www.sourcemage.org)
Key fingerprint = 3CB8 3FC4 840D B272 E623  BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36