Lucene search

K
debianDebianDEBIAN:DLA-226-1:08A6F
HistoryMay 25, 2015 - 6:02 p.m.

[SECURITY] [DLA 226-1] ntfs-3g security update

2015-05-2518:02:01
lists.debian.org
17

CVSS2

3.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:P/A:P

AI Score

6.7

Confidence

High

EPSS

0

Percentile

0.4%

Package : ntfs-3g
Version : 1:2010.3.6-1+deb6u1
CVE ID : CVE-2015-3202

Tavis Ormandy discovered that NTFS-3G, a read-write NTFS driver for
FUSE, does not scrub the environment before executing mount or umount
with elevated privileges. A local user can take advantage of this flaw
to overwrite arbitrary files and gain elevated privileges by accessing
debugging features via the environment that would not normally be safe
for unprivileged users.

CVSS2

3.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:P/A:P

AI Score

6.7

Confidence

High

EPSS

0

Percentile

0.4%