CVE Vulnerability

CVE-2020-14342

It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.

4.4 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 3.4 / Impact : 6.4

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

Scope

7 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 1 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://lists.samba.org/archive/samba-technical/2020-September/135747.html Exploit Mailing List
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14342 Issue Tracking Patch
https://security.gentoo.org/glsa/202009-16 Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00109.html Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JBNFSTJOQWVPFZAUJNNMAPY45PW5RTTE/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DUMRICFXJVCBBOSKZSKT3HFVQM6VPJU3/ Mailing List Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:samba:cifs-utils:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
Information

Published : 2020-09-09 12:15

Updated : 2022-11-16 03:09

NVD link : CVE-2020-14342

Mitre link : CVE-2020-14342

Products Affected
No products.
CWE
CWE-78