Command-line argument injection attack in Kubernetes - CVE-2018-1002101
Published: December 7, 2018 / Updated: December 10, 2018
Vulnerability identifier: #VU16340
CSH Severity: High
CVSS v4: 9.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]
CVE-ID: CVE-2018-1002101
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated attacker to conduct a command-line argument injection attack on a targeted system.
The vulnerability exists due to improper handling user-supplied input when Server Message Block (SMB) volumes are mounted on Windows nodes. A remote authenticated attacker can send specially crafted input to a targeted system while setting up an SMB volume mount, conduct a command-line argument injection attack, which the attacker could use to execute arbitrary code or access or modify sensitive information.
Affected software
Kubernetes
IBM Cloud Pak for Watson AIOps
IBM Cloud Pak for Watson AIOps
How to mitigate CVE-2018-1002101
Install update from vendor's website.
IBM Cloud Pak for Watson AIOps - update to 4.8.1