Gentoo update for smb4K
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2017-8849 |
| CWE-ID | CWE-20 |
| Exploitation vector | Local |
| Public exploit | Public exploit code for vulnerability #1 is available. |
| Vulnerable software |
Gentoo net-misc/smb4k Operating systems & Components / Operating system package or component Other |
| Vendor |
Gentoo |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
1) Improper input validation
EUVDB-ID: #VU6661
Risk: Low
CVSSv4.0: 7.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]
CVE-ID: CVE-2017-8849
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: Yes
DescriptionThe vulnerability allows a local user to elevate privileges.
The vulnerability exists due to an input validation error when verify arguments, sent to the mount helper DBUS service.A local user can send a specially crafted request and execute arbitrary code on the system with root privileges.
Update the affected package to version net-misc/smb4k-1.2.3-r1.
Vulnerable software versionsGentoo net-misc/smb4k: 1.2.2-r1
:
CPE2.3 External linkshttps://security.gentoo.org/glsa/201705-14
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
