CVE-2017-8849: Input Validation
smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify arguments to the mount helper DBUS service.
Other sources
Smb4k contains a logic flaw in which mount helper binary does not properly verify the mount command it is being asked to run. This allows calling any other binary as root since the mount helper is typically installed as suid.
Affected versions: smb4k <= 2.0.0
Upstream fixes:
smb4k 2.0.0: https://commits.kde.org/smb4k/a90289b0962663bc1d247bbbd31b9e65b2ca000e smb4k 1.2.3: https://commits.kde.org/smb4k/71554140bdaede27b95dbe4c9b5a028a83c83cce
External References:
https://www.kde.org/info/security/advisory-20170510-2.txt
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-8849?
CVE-2017-8849 is classified as a critical vulnerability due to its potential for local users to gain root privileges.
How do I fix CVE-2017-8849?
To fix CVE-2017-8849, upgrade to version 2.0.1 or later of smb4k.
Who is affected by CVE-2017-8849?
CVE-2017-8849 affects local users of smb4k versions prior to 2.0.1.
What is the impact of exploiting CVE-2017-8849?
Exploiting CVE-2017-8849 allows local users to execute arbitrary commands with root privileges.
What operating systems are vulnerable to CVE-2017-8849?
CVE-2017-8849 impacts systems running vulnerable versions of smb4k, including certain versions on Debian and Red Hat.