CVE-2007-5159 — File Descriptor Leak in Ntfs-3g

CWE-2645 documents5 sources
Severity
4.6MEDIUMNVD
EPSS
0.0%
top 86.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Tuxera Ntfs-3gNtfs-3g
Timeline
PublishedOct 1
Latest updateMay 1

Description

The ntfs-3g package before 1.913-2.fc7 in Fedora 7, and an ntfs-3g package in Ubuntu 7.10/Gutsy, assign incorrect permissions (setuid root) to mount.ntfs-3g, which allows local users with fuse group membership to read from and write to arbitrary block devices, possibly involving a file descriptor leak.

CVSS vector

AV:L/AC:L/C:P/I:P/A:PExploitability: 3.9 | Impact: 6.4

Affected Packages2 packages

▶Debiantuxera/ntfs-3g< 1:1.913-2+3
▶NVDntfs-3g/ntfs-3g1.913-1.fc7

🔴Vulnerability Details

3
GHSA
GHSA-r584-r284-xhg9: The ntfs-3g package before 1↗2022-05-01
▶
CVEList
CVE-2007-5159: The ntfs-3g package before 1↗2007-10-01
▶
OSV
CVE-2007-5159: The ntfs-3g package before 1↗2007-10-01
▶

📋Vendor Advisories

1
Debian
CVE-2007-5159: ntfs-3g - The ntfs-3g package before 1.913-2.fc7 in Fedora 7, and an ntfs-3g package in Ub...↗2007
▶
CVE-2007-5159 — File Descriptor Leak in Ntfs-3g | cvebase