Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 523
Alerts This Week
Warning Icon 1 523

Debian: DSA-3780-1 Critical NTFS-3G Local Root Escalation

debian
Calendar Grey February 1, 2017
Scroller Debian
The recent NTFS-3G patch resolves a local privilege escalation vulnerability. Debian users are recommended to perform the upgrade to improve system safety.
Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges
Topics%20covered

Topics Covered

security advisory critical debian privilege issue local escalation ntfs-3g modprobe

Summary

Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write
NTFS driver for FUSE, does not scrub the environment before executing
modprobe with elevated privileges. A local user can take advantage of
this flaw for local root privilege escalation.

For the stable distribution (jessie), this problem has been fixed in
version 1:2014.2.15AR.2-1+deb8u3.

For the unstable distribution (sid), this problem has been fixed in
version 1:2016.2.22AR.1-4.

We recommend that you upgrade your ntfs-3g packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/



Severity
critical
Lowest
Low
Medium
High
Critical

Package: ntfs-3g
CVE ID: CVE-2017-0358

Topics%20covered

Topics Covered

security advisory critical debian privilege issue local escalation ntfs-3g modprobe

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.