Описание
Security update for cifs-utils
This update for cifs-utils fixes the following issues:
- CVE-2020-14342: Fixed a shell command injection vulnerability in mount.cifs (bsc#1174477).
- Fixed an invalid free in mount.cifs; (bsc#1152930).
This update was imported from the SUSE:SLE-15-SP1:Update update project.
Список пакетов
openSUSE Leap 15.1
cifs-utils-6.9-lp151.4.7.1
cifs-utils-devel-6.9-lp151.4.7.1
pam_cifscreds-6.9-lp151.4.7.1
Ссылки
- E-Mail link for openSUSE-SU-2020:1579-1
- SUSE Security Ratings
- SUSE Bug 1152930
- SUSE Bug 1174477
- SUSE CVE CVE-2020-14342 page
Описание
It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.
Затронутые продукты
openSUSE Leap 15.1:cifs-utils-6.9-lp151.4.7.1
openSUSE Leap 15.1:cifs-utils-devel-6.9-lp151.4.7.1
openSUSE Leap 15.1:pam_cifscreds-6.9-lp151.4.7.1
Ссылки
- CVE-2020-14342
- SUSE Bug 1174477