smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify arguments to the mount helper DBUS service.

Sebastian Krahmer discovered that a programming error in the mount helper binary of the Smb4k Samba network share browser may result in local privilege escalation.

Security fix for CVE-2017-8849.

https://www.kde.org/info/security/advisory-20170510-2.txt

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Sebastian Krahmer from SUSE discovered that smb4k, a Samba (SMB) share advanced browser, contains a logic flaw in which the mount helper binary does not properly verify the mount command it is being asked to run.

This allows local users to call any other binary as root.

The issue is resolved by backporting version 1.2.1-2 from Debian 9 'Stretch'.

For Debian 7 'Wheezy', these problems have been fixed in version 1.2.1-2~deb7u1.

We recommend that you upgrade your smb4k packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201705-14 (Smb4K: Arbitrary command execution as root)

    Smb4k contains a logic flaw in which mount helper binary does not       properly verify the mount command it is being asked to run.
  Impact :

    A local user can execute commands with the root privilege due to the       mount helper being installed as suid.
  Workaround :

    There is no known workaround at this time.

This update for smb4k fixes the following issues :

  - Disabled dbus service and polkit rules, because this     version of smb4k has a local root exploit issue     (boo#1036245, CVE-2017-8849). Automatic mounting will no     longer be possible to work around this security issue.

ID	Name	Product	Family	Severity
102684	Debian DSA-3951-1 : smb4k - security update	Nessus	Debian Local Security Checks	high
101747	Fedora 26 : smb4k (2017-f7849e04f4)	Nessus	Fedora Local Security Checks	high
101033	Debian DLA-1002-1 : smb4k security update	Nessus	Debian Local Security Checks	high
100446	GLSA-201705-14 : Smb4K: Arbitrary command execution as root	Nessus	Gentoo Local Security Checks	high
100334	Fedora 24 : smb4k (2017-aceb424894)	Nessus	Fedora Local Security Checks	high
100308	Fedora 25 : smb4k (2017-2cc18e2b3b)	Nessus	Fedora Local Security Checks	high
100286	openSUSE Security Update : smb4k (openSUSE-2017-595)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2017-8849

high

Tenable Plugins

high

high

high

high

high

high

high