← Back to branch summary

~ubuntu-security/ubuntu-cve-tracker/master

« back to all changes in this revision

Viewing changes to active/CVE-2014-2886

  • Committer: Steve Beattie
  • Date: 2019-02-19 06:18:27 UTC
  • Revision ID: sbeattie@ubuntu.com-20190219061827-oh57fzcfc1u9dlfk
The ubuntu-cve-tracker project has been converted to git.

Please use 'git clone https://git.launchpad.net/ubuntu-cve-tracker' to
get the converted tree.

Show diffs side-by-side

added added

removed removed

Lines of Context:
active/CVE-2014-2886
1
 
Candidate: CVE-2014-2886
2
 
PublicDate: 2014-09-18
3
 
References:
4
 
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2886
5
 
 https://community.rapid7.com/community/metasploit/blog/2014/07/07/virtualbox-filename-command-execution-via-gksu
6
 
 https://launchpad.net/bugs/1186676
7
 
 http://savannah.nongnu.org/bugs/?40023
8
 
Description:
9
 
 GKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters
10
 
 in a gksu-run-helper argument, which allows attackers to execute arbitrary
11
 
 commands in certain situations involving an untrusted substring within this
12
 
 argument, as demonstrated by an untrusted filename encountered during
13
 
 installation of a VirtualBox extension pack.
14
 
Ubuntu-Description:
15
 
Notes:
16
 
 mdeslaur> in Ubuntu, sudo-mode is the default, and the root account has
17
 
 mdeslaur> no password. On top of that, the fault actually lies in
18
 
 mdeslaur> VirtualBox that is not properly escaping the filename before
19
 
 mdeslaur> calling gksu.
20
 
Bugs:
21
 
Priority: low
22
 
Discovered-by:
23
 
Assigned-to:
24
 
 
25
 
Patches_gksu:
26
 
upstream_gksu: needed
27
 
lucid_gksu: ignored (reached end-of-life)
28
 
precise_gksu: ignored (reached end-of-life)
29
 
precise/esm_gksu: DNE (precise was needed)
30
 
trusty_gksu: needed
31
 
utopic_gksu: ignored (reached end-of-life)
32
 
vivid_gksu: ignored (reached end-of-life)
33
 
vivid/stable-phone-overlay_gksu: DNE
34
 
vivid/ubuntu-core_gksu: DNE
35
 
wily_gksu: ignored (reached end-of-life)
36
 
xenial_gksu: needed
37
 
yakkety_gksu: ignored (reached end-of-life)
38
 
zesty_gksu: ignored (reached end-of-life)
39
 
artful_gksu: needed
40
 
bionic_gksu: DNE
41
 
devel_gksu: DNE