Improper input validation in smb4k - CVE-2017-8849
Published: May 23, 2017 / Updated: September 14, 2018
Vulnerability identifier: #VU6661
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear
CVE-ID: CVE-2017-8849
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
Public exploit is available
Vendor: KDE.org
Affected software:
smb4k
smb4k
Detailed vulnerability description
The vulnerability allows a local user to elevate privileges.
The vulnerability exists due to an input validation error when verify arguments, sent to the mount helper DBUS service.A local user can send a specially crafted request and execute arbitrary code on the system with root privileges.
The vulnerability exists due to an input validation error when verify arguments, sent to the mount helper DBUS service.A local user can send a specially crafted request and execute arbitrary code on the system with root privileges.
How to mitigate CVE-2017-8849
Update to version 2.0.1.