The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3055 advisory.

  - An invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic between     NTFS-3G and the kernel in NTFS-3G through 2021.8.22 when using libfuse-lite. (CVE-2022-30783)

  - A crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value in NTFS-3G through 2021.8.22.
    (CVE-2022-30784)

  - A file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory     read and write operations in NTFS-3G through 2021.8.22 when using libfuse-lite. (CVE-2022-30785)

  - A crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate in NTFS-3G through     2021.8.22. (CVE-2022-30786)

  - An integer underflow in fuse_lib_readdir enables arbitrary memory read operations in NTFS-3G through     2021.8.22 when using libfuse-lite. (CVE-2022-30787)

  - A crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc in NTFS-3G through     2021.8.22. (CVE-2022-30788)

  - A crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array in NTFS-3G     through 2021.8.22. (CVE-2022-30789)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian DLA-3055-1 : ntfs-3g - LTS security update

high Nessus Plugin ID 162427

Version 1.5

Version 1.4

Version 1.4

Version 1.3

Version 1.5 Oct 25, 2023, 7:17 PM CVSSv3 score source (changed from "CVE-2022-30786" to "CVE-2022-30789") Plugin Feed: 202310251917
Version 1.4 Mar 23, 2023, 8:46 PM Plugin requirements Plugin Feed: 202303232046
Version 1.4 Oct 25, 2023, 5:17 PM CVSSv3 score source (changed from "CVE-2022-30786" to "CVE-2022-30789") Plugin Feed: 202310251717
Version 1.3 Sep 29, 2022, 12:06 AM CVSS metrics CVE (Changed from CVE-2022-30789 to CVE-2022-30786) Plugin Feed: 202209290006