PT-2018-2713 · Tuxera+7 · Ntfs-3G+7
Publicado
2018-12-19
·
Atualizado
2022-07-14
·
CVE-2019-9755
CVSS v3.1
7.0
Alta
| Vetor | AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
ntfs-3g version 2017.3.23
Description
An integer underflow issue exists in ntfs-3g, which could be exploited by a local attacker to cause a heap buffer overflow. This could result in a crash or the ability to execute arbitrary code. In installations where /bin/ntfs-3g is a setuid-root binary, this could lead to a local escalation of privileges.
Recommendations
For ntfs-3g version 2017.3.23, consider restricting access to the /bin/ntfs-3g binary to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid running /bin/ntfs-3g with specially crafted arguments from specially crafted directories. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Buffer Overflow
Memory Corruption
Integer Underflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Centos
Red Hat
Rocky Linux
Suse
Ubuntu
Ntfs-3G