PT-2020-16655 · Kde · Kde Partition Manager

Published 2020-10-26 · Updated 2022-04-28 · CVE-2020-27187

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions KDE Partition Manager versions 4.1.0 through 4.1.x

Description A logic flaw exists in the kpmcore externalcommand helper of KDE Partition Manager, where the service invoking D-Bus is not properly checked. This allows an attacker on the local machine to replace /etc/fstab and execute mount and other partitioning related commands while KDE Partition Manager is running, potentially leading to the gain of full root privileges.

Recommendations For versions 4.1.0 through 4.1.x, update to version 4.2.0 or later to resolve the issue.

Fix

Related Identifiers

CVE-2020-27187

Affected Products

Kde Partition Manager

References · 13

• https://security-tracker.debian.org/tracker/CVE-2020-27187 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1890199 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-27187 · Vendor Advisory
• https://security.gentoo.org/glsa/202011-03 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-27187 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-27187 · Security Note
• https://ubuntu.com/security/CVE-2020-27187 · Vendor Advisory
• https://kde.org/info/security/advisory-20201017-1.txt · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-27187 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-27187 · Vendor Advisory
• https://github.com/KDE/partitionmanager/compare/v4.1.0...v4.2.0 · Note
• https://invent.kde.org/system/kpmcore/-/commit/c466c5db11b5cee546d1ec0594c2f1105a354fed · Note
• https://invent.kde.org/system/kpmcore/-/commit/7ec4b611dcf822439b081613cca4184689266454 · Note