Ubuntu Security Notice 3182-1 - Jann Horn discovered that NTFS-3G incorrectly filtered environment variables when using the modprobe utility. A local attacker could possibly use this issue to load arbitrary kernel modules.
d7e87d437e6c386c7a2fd8dbb3bb71070101b552c0748efb494d4cea9373ca4b
==========================================================================
Ubuntu Security Notice USN-3182-1
February 01, 2017
ntfs-3g vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.10
- Ubuntu 16.04 LTS
Summary:
NTFS-3G could be made to load kernel modules as an administrator.
Software Description:
- ntfs-3g: read/write NTFS driver for FUSE
Details:
Jann Horn discovered that NTFS-3G incorrectly filtered environment variables
when using the modprobe utility. A local attacker could possibly use this issue
to load arbitrary kernel modules.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.10:
ntfs-3g 1:2016.2.22AR.1-3ubuntu0.1
Ubuntu 16.04 LTS:
ntfs-3g 1:2015.3.14AR.1-1ubuntu0.1
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-3182-1
CVE-2017-0358
Package Information:
https://launchpad.net/ubuntu/+source/ntfs-3g/1:2016.2.22AR.1-3ubuntu0.1
https://launchpad.net/ubuntu/+source/ntfs-3g/1:2015.3.14AR.1-1ubuntu0.1