Bug 194783

Summary:	sys-fs/ntfs3g Privilege Escalation (CVE-2007-5159)
Product:	Gentoo Security	Reporter:	Tobias Heinlein (RETIRED) <keytoaster>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED WONTFIX
Severity:	major	CC:	chutzpah, jakub
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B1 [noglsa]
Package list:		Runtime testing required:	---

Description Tobias Heinlein (RETIRED) gentoo-dev

2007-10-05 09:34:08 UTC

CVE-2007-5159 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5159):
  The ntfs-3g package before 1.913-2.fc7 in Fedora 7, and an ntfs-3g package in
  Ubuntu 7.10/Gutsy, assign incorrect permissions (setuid root) to
  mount.ntfs-3g, which allows local users with fuse group membership to read
  from and write to arbitrary block devices, possibly involving a file
  descriptor leak.

Comment 1 Tobias Heinlein (RETIRED) gentoo-dev

2007-10-05 09:38:08 UTC

The ebuild sets the suid on /bin/ntfs-3g, and /sbin/mount.ntfs-3g is a symlink to this file, so it seems we are affected by this, too. Maintainer, please advise and/or create a fixed ebuild.

Comment 2 Jakub Moc (RETIRED) gentoo-dev

2007-10-05 09:48:47 UTC

(In reply to comment #1)
> The ebuild sets the suid on /bin/ntfs-3g, and /sbin/mount.ntfs-3g is a symlink
> to this file, so it seems we are affected by this, too. Maintainer, please
> advise and/or create a fixed ebuild.
> 

Uh...

- we only do this with USE=suid set
- we explicitely warn users about possible consequences

<snip>
ewarn "You have chosen to install ${PN} with the binary setuid root. This"
ewarn "means that if there any undetected vulnerabilities in the binary,"
ewarn "then local users may be able to gain root access on your machine."
</snip>

- removing suid bit is supposed to be a fix? That's a joke, right?

Comment 3 Patrick McLean gentoo-dev

2007-10-05 14:56:28 UTC

As Jakub pointed out, by default this does not affect us, and we explicitly warn the user about the possibility of vulnerabilities if they enable setting suid. 

Frankly, I don't think it is an issue, if you disagree please explain why you think it is still an issue.

Comment 4 Tobias Heinlein (RETIRED) gentoo-dev

2007-10-05 15:13:47 UTC

Fine then, closing.

Comment 5 Raphael Marichez (Falco) (RETIRED) gentoo-dev

2007-10-22 20:09:12 UTC

reopening since it is not "fixed" at all...

Comment 6 Raphael Marichez (Falco) (RETIRED) gentoo-dev

2007-10-22 20:10:36 UTC

and closing as WONTFIX (or INVALID perhaps) since nothing will be changed.