PT-2017-10547 · Ntfs-3G+3 · Ntfs-3G+3

Jann Horn · Publicado 2017-02-01 · Atualizado 2021-09-07 · CVE-2017-0358

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NTFS-3G (affected versions not specified)

Description A local user can exploit a flaw in NTFS-3G to escalate local root privileges. The issue arises because NTFS-3G does not scrub the environment before executing modprobe with elevated privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

ALT-PU-2017-1420

CVE-2017-0358

DLA-815-1

DSA-3780-1

OPENSUSE-SU-2018_3696-1

SUSE-SU-2018:2070-1

SUSE-SU-2018:3587-1

SUSE-SU-2018:3587-2

SUSE-SU-2018_2070-1

SUSE-SU-2018_3587-1

SUSE-SU-2018_3587-2

SUSE-SU-2021:2965-1

SUSE-SU-2021_2965-1

USN-3182-1

Produtos afetados

Alt Linux

Ntfs-3G

Suse

Ubuntu

Referências · 50

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/ntfs3g_priv_esc.rb · Exploit
• 🔥 https://exploit-db.com/exploits/41356 · Exploit
• 🔥 https://exploit-db.com/exploits/41240 · Exploit
• 🔥 https://marc.info/?l=oss-security&m=148594671929354&w=2 · Exploit
• https://suse.com/security/cve/CVE-2021-39263 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2018:3587-2 · Aviso do Fabricante
• http://securityfocus.com/bid/95987 · Nota
• https://suse.com/security/cve/CVE-2019-9755 · Nota
• https://bugzilla.suse.com/1189720 · Nota
• https://cve.org/CVERecord?id=CVE-2017-0358 · Nota de Segurança
• https://ubuntu.com/security/notices/USN-3182-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2021-33286 · Nota
• https://suse.com/security/cve/CVE-2021-39251 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2018:2070-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-3182-1 · Aviso do Fabricante