NVD

Id
31209  
Name
CVE-2014-2886  
Description
GKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters in a gksu-run-helper argument, which allows attackers to execute arbitrary commands in certain situations involving an untrusted substring within this argument, as demonstrated by an untrusted filename encountered during installation of a VirtualBox extension pack.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2014-09-18  
Modified Date
2014-09-18  
Seq
2014-2886  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
163680 31209 CVE-2014-2886 http://savannah.nongnu.org/bugs/?40023  View
163681 31209 CVE-2014-2886 https://community.rapid7.com/community/metasploit/blog/2014/07/07/virtualbox-filename-command-execution-via-gksu  View
163682 31209 CVE-2014-2886 https://launchpad.net/bugs/1186676  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
15412 JVNDB-2014-004287 GKSu における任意のコマンドを実行される脆弱性 GKSu には、sudo-mode が有効ではない場合、gksu-run-helper 引数において " (二重引用符) 文字を使用するため、引数内に信頼できない文字列を含む特定の状況で、任意のコマンドを実行される脆弱性が存在します。 CVE-2014-2886 70173 CVE-2014-2886 31209 6.8 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-004287.html 2014-09-18 2014-09-19 View