#VU6661 Improper input validation in smb4k - CVE-2017-8849

Vulnerability identifier: #VU6661

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear

CVE-ID: CVE-2017-8849

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: Public exploit is available

Vulnerable software:
smb4k

Software vendor:
KDE.org

The vulnerability allows a local user to elevate privileges.

The vulnerability exists due to an input validation error when verify arguments, sent to the mount helper DBUS service.A local user can send a specially crafted request and execute arbitrary code on the system with root privileges.

Update to version 2.0.1.

• http://www.openwall.com/lists/oss-security/2017/05/10/3
• https://www.kde.org/info/security/advisory-20170510-2.txt