Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 488
Alerts This Week
Warning Icon 1 488

Gentoo: GLSA-201705-14 Normal: Smb4K Command Execution Risk

gentoo
Calendar Grey May 26, 2017
Scroller Gentoo
The Smb4K security flaw allows unauthorized local users to execute commands with root privileges. Here are measures to safeguard your Gentoo system against this threat.
A vulnerability in Smb4K could allow local attackers to execute commands as root.

Summary

Smb4k contains a logic flaw in which mount helper binary does not properly verify the mount command it is being asked to run.

Topics%20covered

Topics Covered

security advisory gentoo command execution threat local access normal smb4k

Resolution

All Smb4K users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/smb4k-1.2.3-r1:4 "

References

[ 1 ] CVE-2017-8849 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-8849

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201705-14
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity: Normal
Title: Smb4K: Arbitrary command execution as root
Date: May 26, 2017
Bugs: #618106
ID: 201705-14

Topics%20covered

Topics Covered

security advisory gentoo command execution threat local access normal smb4k

Synopsis

A vulnerability in Smb4K could allow local attackers to execute commands as root.

Background

Smb4K is a SMB/CIFS (Windows) share browser for KDE.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-misc/smb4k < 1.2.3-r1  >= 1.2.3-r1 

Impact

===== A local user can execute commands with the root privilege due to the mount helper being installed as suid.

Workaround

There is no known workaround at this time.