{"id":"CVE-2017-8849","aliases":["DEBIAN-CVE-2017-8849","DLA-1002-1","DSA-3951-1","EUVD-2017-17791","GHSA-r2c6-g9q3-2m7j","MGASA-2017-0171","UBUNTU-CVE-2017-8849","openSUSE-SU-2026:10370-1"],"status":"published","title":"smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify...","description":"smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify arguments to the mount helper DBUS service.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01948,"percentile":0.80341,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20"],"published":"2017-05-17T14:00:00Z","modified":"2026-09-01T20:03:51Z","exploits":[{"source":"exploitdb","id":"EDB-42053","title":"KDE 4/5 - 'KAuth' Local Privilege Escalation","type":"local","platform":"linux","date":"2017-05-18","url":"https://www.exploit-db.com/exploits/42053"}],"fixes":[{"ecosystem":"Debian:13","package":"smb4k","fixed_in":["1.2.1-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"smb4k","fixed_in":["1.2.1-2"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"smb4k","fixed_in":["1.2.1-2~deb7u1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"smb4k","fixed_in":["1.2.1-2~deb8u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"smb4k","fixed_in":["1.2.3-1.mga5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"smb4k","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"smb4k","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-2"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"smb4k","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-2~deb7u1"}]}],"versions":["1.0.1-1","1.0.6-1","1.0.7-1","1.0.8-1","1.0.9-1","1.1.2-1","1.2.1-1"]},{"source":"osv","ecosystem":"Debian:8","package":"smb4k","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-2~deb8u1"}]}],"versions":["1.1.2-1","1.2.1-1","1.2.1-2~deb7u1"]},{"source":"osv","ecosystem":"Mageia:5","package":"smb4k","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-1.mga5"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"smb4k","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.2-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"smb4k","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.5-1.2"}]}],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"smb4k_project","product":"smb4k"}],"references":[{"url":"https://cgit.kde.org/smb4k.git/commit/?id=a90289b0962663bc1d247bbbd31b9e65b2ca000e","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://www.exploit-db.com/exploits/42053/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1449656","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","VDB Entry","fix"]},{"url":"http://www.debian.org/security/2017/dsa-3951","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201705-14","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.kde.org/info/security/advisory-20170510-2.txt","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://cgit.kde.org/smb4k.git/commit/?id=71554140bdaede27b95dbe4c9b5a028a83c83cce","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://www.securityfocus.com/bid/98690","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2017/05/10/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Mailing List","Patch","Third Party Advisory","fix","report"]},{"url":"http://www.securityfocus.com/bid/98737","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-8849"},{"url":"https://www.exploit-db.com/exploits/42053"},{"url":"https://github.com/advisories/GHSA-r2c6-g9q3-2m7j"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-8849","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0171.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20844","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-8849","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-8849","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66002","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-8849","description":"smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify arguments to the mount helper DBUS service.","status":"published","published":"2017-05-17T14:00:00Z","modified":"2024-08-05T16:48:22.882Z","updated_at":"2026-11-02T14:33:14.89365Z"}],"euvd":[{"id":"EUVD-2017-17791","description":"smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify arguments to the mount helper DBUS service.","status":"published","published":"2017-05-17T14:00:00Z","modified":"2024-08-05T16:48:22Z","updated_at":"2026-11-03T02:23:29.67797Z"}],"ghsa":[{"id":"GHSA-r2c6-g9q3-2m7j","title":"smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify...","description":"smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify arguments to the mount helper DBUS service.","status":"published","published":"2022-05-14T01:19:56Z","modified":"2025-04-20T03:38:50Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:01:46.283604Z"}],"nvd":[{"id":"CVE-2017-8849","description":"smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify arguments to the mount helper DBUS service.","status":"published","published":"2017-05-17T14:29:00.433Z","modified":"2026-06-17T01:27:04.553Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:47.848196Z"}],"osv":[{"id":"CVE-2017-8849","description":"smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify arguments to the mount helper DBUS service.","status":"published","published":"2017-05-17T14:29:00.433Z","modified":"2026-04-16T06:16:47.294268742Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:06.868403Z"},{"id":"DEBIAN-CVE-2017-8849","description":"smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify arguments to the mount helper DBUS service.","status":"published","published":"2017-05-17T14:29:00.433Z","modified":"2026-09-01T20:03:51.103044342Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.698576Z"},{"id":"UBUNTU-CVE-2017-8849","description":"smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify arguments to the mount helper DBUS service.","status":"published","published":"2017-05-17T14:29:00Z","modified":"2025-10-24T04:46:19Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:16.154988Z"},{"id":"DLA-1002-1","title":"smb4k - security update","status":"published","published":"2017-06-25T00:00:00Z","modified":"2026-03-09T01:01:35.079279Z","updated_at":"2026-11-02T15:46:08.746073Z"},{"id":"DSA-3951-1","title":"smb4k - security update","status":"published","published":"2017-08-22T00:00:00Z","modified":"2026-03-09T01:22:44.370051Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2017-0171","title":"Updated smb4k packages fix security vulnerability","description":"Smb4k contains a logic flaw in which mount helper binary does not properly\nverify the mount command it is being asked to run. This allows calling any\nother binary as root since the mount helper is typically installed as suid\n(CVE-2017-8849).\n","status":"published","published":"2017-06-14T13:50:35Z","modified":"2026-04-16T06:23:11.292840763Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2026:10370-1","title":"smb4k-4.0.5-1.2 on GA media","description":"These are all security issues fixed in the smb4k-4.0.5-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-13T00:00:00Z","modified":"2026-03-14T08:18:00.981095Z","updated_at":"2026-11-02T16:58:38.415593Z"}]}}