CVE-2018-6791
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
An issue was discovered in soliduiserver/deviceserviceaction.cpp in KDE Plasma Workspace before 5.12.0. When a vfat thumbdrive that contains `` or $() in its volume label is plugged in and mounted through the device notifier, it's interpreted as a shell command, leading to a possibility of arbitrary command execution. An example of an offending volume label is "$(touch b)" -- this will create a file called b in the home folder.
Se ha descubierto un problema en soliduiserver/deviceserviceaction.cpp en KDE Plasma Workspace en versiones anteriores a la 5.12.0. Cuando una memoria USB vfat que contiene `` o $() en la etiqueta de la partición se enchufa o monta a través del notificador del dispositivo, se interpreta como un comando shell, lo que permite que se ejecuten comandos arbitrarios. Un ejemplo de etiqueta de partición maliciosa es "$(touch b)" -- esto crearía un archivo llamado b en la carpeta home.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2018-02-06 CVE Reserved
- 2018-02-07 CVE Published
- 2023-03-07 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CAPEC
References (3)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://bugs.kde.org/show_bug.cgi?id=389815 | 2019-10-03 | |
https://cgit.kde.org/plasma-workspace.git/commit/?id=9db872df82c258315c6ebad800af59e81ffb9212 | 2019-10-03 | |
https://www.debian.org/security/2018/dsa-4116 | 2019-10-03 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Kde Search vendor "Kde" | Plasma-workspace Search vendor "Kde" for product "Plasma-workspace" | < 5.12.0 Search vendor "Kde" for product "Plasma-workspace" and version " < 5.12.0" | - |
Affected
| ||||||
Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
|