Lucene search

K
debianDebianDEBIAN:DLA-226-2:892CF
HistoryMay 26, 2015 - 8:21 p.m.

[SECURITY] [DLA 226-2] ntfs-3g regression update

2015-05-2620:21:20
lists.debian.org
13

CVSS2

3.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:P/A:P

AI Score

6.7

Confidence

High

EPSS

0

Percentile

0.4%

Package : ntfs-3g
Version : 1:2010.3.6-1+deb6u2
CVE ID : CVE-2015-3202

The patch applied for ntfs-3g to fix CVE-2015-3202 in DLA 226-1 was
incomplete. This update corrects that problem. For reference the
original advisory text follows.

Tavis Ormandy discovered that NTFS-3G, a read-write NTFS driver for
FUSE, does not scrub the environment before executing mount or umount
with elevated privileges. A local user can take advantage of this flaw
to overwrite arbitrary files and gain elevated privileges by accessing
debugging features via the environment that would not normally be safe
for unprivileged users.

CVSS2

3.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:P/A:P

AI Score

6.7

Confidence

High

EPSS

0

Percentile

0.4%