Smb4K CVE-2017-8849 Local Privilege Escalation Vulnerability

Bugtraq ID:	98690
Class:	Configuration Error
CVE:	CVE-2017-8849
Remote:	No
Local:	Yes
Published:	May 10 2017 12:00AM
Updated:	Aug 23 2017 09:11AM
Credit:	Sebastian Krahmer
Vulnerable:	Smb4k Smb4k 2.0 Smb4k Smb4k 1.2.3 Smb4k Smb4k 1.1.1 Smb4k Smb4k 1.1 Smb4k Smb4k 0.8 Smb4k Smb4k 0.7.5 Smb4k Smb4k 0.6.3 Smb4k Smb4k 0.6 Smb4k Smb4k 0.5.1 Smb4k Smb4k 0.5 Smb4k Smb4k 0.4 openSUSE Leap 42.2 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:	Smb4k Smb4k 2.0.1

Smb4K CVE-2017-8849 Local Privilege Escalation Vulnerability

Smb4K is prone to a local privilege-escalation vulnerability.

A local attacker can exploit this issue to execute arbitrary command with root privileges.

Smb4K 2.0.0 and prior versions are vulnerable.

Smb4K CVE-2017-8849 Local Privilege Escalation Vulnerability

Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Smb4K CVE-2017-8849 Local Privilege Escalation Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Smb4K CVE-2017-8849 Local Privilege Escalation Vulnerability

References:

• Bug 1449656 - (CVE-2017-8849) CVE-2017-8849 smb4k: unauthorized local command ex (Red Hat Bugzilla)
  
• Find the mount/umount commands in the helper (KDE)
  
• Find the mount/umount commands in the helper (KDE)
  
• Smb4K Home Page (KDE)
  
• smb4k: unauthorized local command execution as root (KDE)