CVE-2015-3202

NameCVE-2015-3202
Descriptionfusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-226-1, DLA-226-2, DLA-238-1, DSA-3266-1, DSA-3268-1, DSA-3268-2
NVD severitylow (attack range: local)
Debian Bugs786439, 786475

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
fuse (PTS)wheezy, wheezy (security)2.9.0-2+deb7u2fixed
jessie (security), jessie2.9.3-15+deb8u2fixed
buster, sid, stretch2.9.7-1fixed
ntfs-3g (PTS)wheezy1:2012.1.15AR.5-2.1+deb7u2fixed
wheezy (security)1:2012.1.15AR.5-2.1+deb7u3fixed
jessie (security), jessie1:2014.2.15AR.2-1+deb8u3fixed
stretch1:2016.2.22AR.1+dfsg-1fixed
buster, sid1:2017.3.23-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
fusesource(unstable)2.9.3-16low786439
fusesourcejessie2.9.3-15+deb8u1lowDSA-3266-1
fusesourcesqueeze2.8.4-1.1+deb6u1lowDLA-238-1
fusesourcewheezy2.9.0-2+deb7u2lowDSA-3266-1
ntfs-3gsource(unstable)1:2014.2.15AR.3-3low786475
ntfs-3gsourcejessie1:2014.2.15AR.2-1+deb8u2lowDSA-3268-2
ntfs-3gsourcesqueeze1:2010.3.6-1+deb6u2lowDLA-226-2
ntfs-3gsourcewheezy1:2012.1.15AR.5-2.1+deb7u2lowDSA-3268-2

Notes

Upstream fix: http://web.archive.org/web/20150529051222/http://sourceforge.net:80/p/fuse/fuse/ci/fe2d96
ntfs-3g source wise affected but wheezy version uses --with-fuse=external
ntfs-3g is built with internal copy since 1:2013.1.13AR.3-2

Search for package or bug name: Reporting problems