CVE-2014-2527: Medium severity kdirstat vulnerability
Adrian Panasiuk discovered that the KDirStat (KDE Directory Statistics) tool did not correctly escape quotes when deleting a directory permanently. Attempting to use KDirStat to permanently delete a directory that has a malicious name could result in arbitrary command execution.
The original report is regarding single quotes. Testing with the Fedora revealed the issue there was with double quotes.
Original report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=741659
Other sources
kcleanup.cpp in KDirStat 2.7.0 does not properly quote strings when deleting a directory, which allows remote attackers to execute arbitrary commands via a " (double quote) character in the directory name, a different vulnerability than CVE-2014-2528.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2527?
CVE-2014-2527 has a high severity level due to the potential for arbitrary command execution.
How do I fix CVE-2014-2527?
To fix CVE-2014-2527, update KDirStat to the latest version that has addressed this vulnerability.
Which software is affected by CVE-2014-2527?
CVE-2014-2527 affects KDirStat version 2.7.0 and openSUSE version 13.1.
What kind of attack does CVE-2014-2527 facilitate?
CVE-2014-2527 facilitates an attack that could lead to arbitrary command execution when deleting directories.
Who discovered CVE-2014-2527?
CVE-2014-2527 was discovered by Adrian Panasiuk.