PT-2019-9987 · Suse · Yast2-Printer

Dainius Masiliunas · Publicado 2019-03-15 · Atualizado 2019-10-09 · CVE-2018-20106

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions yast2-printer versions prior to 4.0.3

Description The issue is related to the SMB printer settings in yast2-printer, where passwords are not properly escaped, allowing for code execution as root if a password with special characters, such as backticks, is supplied. This requires tricking the root user into entering such a password in yast.

Recommendations For versions prior to 4.0.3, update to version 4.0.3 or later to resolve the issue. As a temporary workaround, consider avoiding the use of passwords with special characters, such as backticks, in the SMB printer settings until the issue is resolved.

Exploit

Correção

OS Command Injection

RCE

Enumeração de Fraquezas

CWE-78

CWE-20

Identificadores relacionados

CVE-2018-20106

Produtos afetados

Yast2-Printer

Referências · 3

• 🔥 https://bugzilla.suse.com/show_bug.cgi?id=1114853 · Exploit
• https://osv.dev/vulnerability/CVE-2018-20106 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-20106 · Nota de Segurança