CVE-2020-14342
Published: 9 September 2020
It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
cifs-utils Launchpad, Ubuntu, Debian |
bionic |
Released
(2:6.8-1ubuntu1.2)
|
| focal |
Released
(2:6.9-1ubuntu0.2)
|
|
| groovy |
Released
(2:6.11-0ubuntu1)
|
|
| hirsute |
Released
(2:6.11-0ubuntu1)
|
|
| impish |
Released
(2:6.11-0ubuntu1)
|
|
| jammy |
Released
(2:6.11-0ubuntu1)
|
|
| kinetic |
Released
(2:6.11-0ubuntu1)
|
|
| lunar |
Released
(2:6.11-0ubuntu1)
|
|
| mantic |
Released
(2:6.11-0ubuntu1)
|
|
| noble |
Released
(2:6.11-0ubuntu1)
|
|
| trusty |
Needed
|
|
| upstream |
Released
(6.11)
|
|
| xenial |
Needed
|
|
|
Patches: upstream: https://git.samba.org/cifs-utils.git/?p=cifs-utils.git;a=commit;h=48a654e2e763fce24c22e1b9c695b42804bbdd4a |
||
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 7.0 |
| Attack vector | Local |
| Attack complexity | High |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |