Debian Bug report logs -
#862505
smb4k: CVE-2017-8849
Package:
src:smb4k;
Maintainer for src:smb4k is Debian KDE Extras Team <pkg-kde-extras@listsaliothdebianorg>;
Reported by: Salvatore Bonaccorso <carnil@debianorg>
Date: Sat, 13 May 2017 18:45:02 UTC
Severity: important
Tags: patch, security, upstream
Found in ...
Sebastian Krahmer discovered that a programming error in the mount
helper binary of the Smb4k Samba network share browser may result in
local privilege escalation
For the oldstable distribution (jessie), this problem has been fixed
in version 121-2~deb8u1
We recommend that you upgrade your smb4k packages ...
Smb4k <= 200 contains a logic flaw in which mount helper binary does not properly verify the mount command it is being asked to run This allows calling any other binary as root since the mount helper is typically installed as suid ...
PLASMA PULSAR
CVE-2017-8422, CVE-2017-8849
This document describes a generic root exploit against kde
The exploit is achieved by abusing a logic flaw within
the KAuth framework which is present in kde4 (orgkdeauth) and kde5
(orgkdekf5auth) It is possible to spoof what KAuth calls
callerID's which are indeed D-Bus unique names of the sender of a D-Bus
message
Exploit
Vulmon