CVE-2018-12562

Published: Jun 19, 2018Modified: Nov 21, 2024

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The wrapper script 'mount.cifs.wrapper' uses the shell to forward the arguments to the actual mount.cifs binary. The shell evaluates wildcards (such as in an injected string:/home/../tmp/* string).

Affected (1)

Products: Cantata Project: Cantata

Cantata Project

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Cantata Project Cantata	Up to 2.3.1

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (4)

http://www.openwall.com/lists/oss-security/2018/06/18/1

Source: cve@mitre.org

Mailing ListTechnical Description

https://github.com/CDrummond/cantata/commit/afc4f8315d3e96574925fb530a7004cc9e6ce3d3

Source: cve@mitre.org

PatchTechnical Description

http://www.openwall.com/lists/oss-security/2018/06/18/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListTechnical Description

https://github.com/CDrummond/cantata/commit/afc4f8315d3e96574925fb530a7004cc9e6ce3d3

Source: af854a3a-2127-422b-91ae-364da2661108

PatchTechnical Description

Timeline

No history available yet.