CVE-2014-2886 GKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters in a gksu-run-helper argument, which allows attackers to execute arbitrary commands in certain situations involving an untru...
MediumCVSS 6.8
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
GKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters in a gksu-run-helper argument, which allows attackers to execute arbitrary commands in certain situations involving an untrusted substring within this argument, as demonstrated by an untrusted filename encountered during installation of a VirtualBox extension pack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nongnu gksu | = 2.0.2 | No fix listed |
References
- savannah.nongnu.org
- community.rapid7.com exploit
- launchpad.net
- GLSA-201812-10 vendor-advisory