Improper input validation in smb4k - CVE-2017-8849
Published: May 23, 2017 / Updated: September 14, 2018
Vulnerability identifier: #VU6661
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-8849
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a local user to elevate privileges.
The vulnerability exists due to an input validation error when verify arguments, sent to the mount helper DBUS service.A local user can send a specially crafted request and execute arbitrary code on the system with root privileges.
The vulnerability exists due to an input validation error when verify arguments, sent to the mount helper DBUS service.A local user can send a specially crafted request and execute arbitrary code on the system with root privileges.
Affected software
smb4k
Arch Linux
Debian Linux
Fedora
Opensuse
Gentoo net-misc/smb4k
smb4k
Arch Linux
Debian Linux
Fedora
Opensuse
Gentoo net-misc/smb4k
smb4k
How to mitigate CVE-2017-8849
Update to version 2.0.1.
smb4k - addressed in versions 1.2.2-3.fc24, 1.2.2-3.fc25, 1.2.2-3.fc26, 1.2.3-1.fc26