Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Gentoo: GLSA-201701-19 Normal: NTFS-3G Privilege Escalation Critical

gentoo
Calendar Grey January 11, 2017
Dist Gentoo Esm H88
An issue has been found in NTFS-3G on Arch Linux that permits local users to escalate their privileges to root. It is recommended to update for protection.
A vulnerability in NTFS-3G allows local users to gain root privileges.

Summary

NTFS-3G is affected by the same vulnerability as reported in "GLSA 201603-04" when the bundled fuse-lite implementation is used.

Topics%20covered

Topics Covered

security advisory gentoo privilege escalation local exploit root access normal severity ntfs-3g

Resolution

All NTFS-3G users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=sys-fs/ntfs3g-2016.2.22"

References

[ 1 ] CVE-2015-3202 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3202 [ 2 ] GLSA 201603-04 https://security.gentoo.org/glsa/201603-04

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201701-19
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity: Normal
Title: NTFS-3G: Privilege escalation
Date: January 11, 2017
Bugs: #550970
ID: 201701-19

Topics%20covered

Topics Covered

security advisory gentoo privilege escalation local exploit root access normal severity ntfs-3g

Synopsis

A vulnerability in NTFS-3G allows local users to gain root privileges.

Background

NTFS-3G is a stable, full-featured, read-write NTFS driver for various operating systems.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 sys-fs/ntfs3g < 2016.2.22 >= 2016.2.22

Impact

===== A local user could gain root privileges.

Workaround

There is no known workaround at this time. However, on Gentoo when the "external-fuse" USE flag is set or the "suid" USE flag is not set then NTFS-3G is not affected. Both of these cases are the default configuration.

Your message here