A vulnerability was found in ntfs-3g 2017.3.23 and classified as problematic. Affected by this issue is an unknown code of the file /bin/ntfs-3g. The manipulation as part of a Argument leads to a integer underflow vulnerability. Using CWE to declare the problem leads to CWE-191. The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. Impacted is confidentiality, integrity, and availability. CVE summarizes:

An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by running /bin/ntfs-3g with specially crafted arguments from a specially crafted directory to cause a heap buffer overflow, resulting in a crash or the ability to execute arbitrary code. In installations where /bin/ntfs-3g is a setuid-root binary, this could lead to a local escalation of privileges.

The weakness was disclosed 06/05/2019 (Website). The advisory is shared for download at access.redhat.com. This vulnerability is handled as CVE-2019-9755 since 03/13/2019. The attack needs to be approached locally. A simple authentication is needed for exploitation. There are known technical details, but no exploit is available.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 197398 (Ubuntu Security Notification for Ntfs-3g Vulnerability (USN-3914-1)).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Productinfo

Name

• ntfs-3g

Version

• 2017.3.23

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion