CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:N/I:P/A:P
AI Score
Confidence
High
EPSS
Percentile
0.4%
Package : ntfs-3g
Version : 1:2010.3.6-1+deb6u2
CVE ID : CVE-2015-3202
The patch applied for ntfs-3g to fix CVE-2015-3202 in DLA 226-1 was
incomplete. This update corrects that problem. For reference the
original advisory text follows.
Tavis Ormandy discovered that NTFS-3G, a read-write NTFS driver for
FUSE, does not scrub the environment before executing mount or umount
with elevated privileges. A local user can take advantage of this flaw
to overwrite arbitrary files and gain elevated privileges by accessing
debugging features via the environment that would not normally be safe
for unprivileged users.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 7 | s390x | ntfs-3g-udeb | < 1:2012.1.15AR.5-2.1+deb7u2 | ntfs-3g-udeb_1:2012.1.15AR.5-2.1+deb7u2_s390x.deb |
Debian | 8 | s390x | libfuse-dev | < 2.9.3-15+deb8u1 | libfuse-dev_2.9.3-15+deb8u1_s390x.deb |
Debian | 7 | amd64 | ntfs-3g-dbg | < 1:2012.1.15AR.5-2.1+deb7u2 | ntfs-3g-dbg_1:2012.1.15AR.5-2.1+deb7u2_amd64.deb |
Debian | 7 | s390x | libfuse2 | < 2.9.0-2+deb7u2 | libfuse2_2.9.0-2+deb7u2_s390x.deb |
Debian | 7 | armel | libfuse2 | < 2.9.0-2+deb7u2 | libfuse2_2.9.0-2+deb7u2_armel.deb |
Debian | 7 | mips | libfuse2 | < 2.9.0-2+deb7u2 | libfuse2_2.9.0-2+deb7u2_mips.deb |
Debian | 7 | kfreebsd-amd64 | libfuse2-udeb | < 2.9.0-2+deb7u2 | libfuse2-udeb_2.9.0-2+deb7u2_kfreebsd-amd64.deb |
Debian | 7 | i386 | fuse | < 2.9.0-2+deb7u2 | fuse_2.9.0-2+deb7u2_i386.deb |
Debian | 8 | armhf | fuse-udeb | < 2.9.3-15+deb8u1 | fuse-udeb_2.9.3-15+deb8u1_armhf.deb |
Debian | 8 | s390x | ntfs-3g-udeb | < 1:2014.2.15AR.2-1+deb8u2 | ntfs-3g-udeb_1:2014.2.15AR.2-1+deb8u2_s390x.deb |