OS Command Injection in cifs-utils - CVE-2020-14342

Vulnerability identifier: #VU46731

CSH Severity: Low

CVSS v4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-14342

CWE-ID: CWE-78

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local authenticated user to execute arbitrary code.

It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.

cifs-utils
Gentoo Linux
Ubuntu
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
Opensuse
Fedora
libproxy (Alpine package)
geary (Alpine package)
cifs-utils (Ubuntu package)
cifs-utils
cifs-utils-debuginfo
cifs-utils-debugsource
cifs-utils-devel

Install update from vendor's website.

cifs-utils - update to 6.11
libproxy (Alpine package) - update to 0.4.15-r8
cifs-utils (Ubuntu package) - addressed in versions 2:6.0-1ubuntu2+esm1, 2:6.4-1ubuntu1.1+esm1, 2:6.8-1ubuntu1.2, 2:6.9-1ubuntu0.2, 2:6.11-3.1ubuntu0.1, 2:6.14-1ubuntu0.1
cifs-utils - update to 6.9-3.14.1
cifs-utils-debuginfo - update to 6.9-3.14.1
cifs-utils-debugsource - update to 6.9-3.14.1
cifs-utils-devel - update to 6.9-3.14.1
cifs-utils - addressed in versions 6.11-1.fc32, 6.11-1.fc33

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14342
• https://lists.samba.org/archive/samba-technical/2020-September/135747.html

• OS Command Injection in cifs-utils (Alpine package)
• Gentoo update for LinuxCIFS
• OpenSUSE Linux update for cifs-utils
• OS command injection in cifs-utils
• Ubuntu update for cifs-utils
• SUSE update for cifs-utils
• Fedora 33 update for cifs-utils
• Fedora 32 update for cifs-utils
• Ubuntu update for cifs-utils