CVE-2020-14342
Publication date 9 September 2020
Last updated 24 July 2024
Ubuntu priority
Cvss 3 Severity Score
It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.
Status
Package | Ubuntu Release | Status |
---|---|---|
cifs-utils | 24.04 LTS noble |
Fixed 2:6.11-0ubuntu1
|
22.04 LTS jammy |
Fixed 2:6.11-0ubuntu1
|
|
20.04 LTS focal |
Fixed 2:6.9-1ubuntu0.2
|
|
18.04 LTS bionic |
Fixed 2:6.8-1ubuntu1.2
|
|
16.04 LTS xenial |
Vulnerable
|
|
14.04 LTS trusty |
Vulnerable
|
Patch details
Package | Patch details |
---|---|
cifs-utils |
Severity score breakdown
Parameter | Value |
---|---|
Base score | 7.0 · High |
Attack vector | Local |
Attack complexity | High |
Privileges required | Low |
User interaction | None |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | High |
Availability impact | High |
Vector | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
References
Related Ubuntu Security Notices (USN)
- USN-5459-1
- cifs-utils vulnerabilities
- 2 June 2022