GLSA-201702-10 : NTFS-3G: Privilege escalation

This script is Copyright (C) 2017 Tenable Network Security, Inc.


Synopsis :

The remote Gentoo host is missing one or more security-related
patches.

Description :

The remote host is affected by the vulnerability described in GLSA-201702-10
(NTFS-3G: Privilege escalation)

The NTFS-3G driver does not properly clear environment variables before
invoking mount or umount.
This flaw is similar to the vulnerability described in
“GLSA-201701-19” and “GLSA-201603-04” referenced below but is now
implemented in the NTFS-3G driver itself.

Impact :

A local user could gain root privileges.

Workaround :

There is no known workaround at this time. However, on Gentoo when the
“suid” USE flag is not set (which is the default) an attacker cannot
exploit the flaw.

See also :

https://security.gentoo.org/glsa/201603-04
https://security.gentoo.org/glsa/201701-19
https://security.gentoo.org/glsa/201702-10

Solution :

All NTFS-3G users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose '>=sys-fs/ntfs3g-2016.2.22-r2'

Risk factor :

Medium

Family: Gentoo Local Security Checks

Nessus Plugin ID: 97253 ()

Bugtraq ID:

CVE ID: CVE-2017-0358

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now