CVEvulnerability
CVE-2014-2886
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-09-18
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-264
Description
GKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters in a gksu-run-helper argument, which allows attackers to execute arbitrary commands in certain situations involving an untrusted substring within this argument, as demonstrated by an untrusted filename encountered during installation of a VirtualBox extension pack.
Affected configurations
• nongnu gksu 2.0.2
Related
Weakness · not in database (1)
References
- http://savannah.nongnu.org/bugs/?40023 savannah.nongnu.org
- https://community.rapid7.com/community/metasploit/blog/2014/07/07/virtualbox-filename-command-execution-via-gksu Exploit
- https://launchpad.net/bugs/1186676 launchpad.net
- https://security.gentoo.org/glsa/201812-10 security.gentoo.org
- http://savannah.nongnu.org/bugs/?40023 savannah.nongnu.org
- https://community.rapid7.com/community/metasploit/blog/2014/07/07/virtualbox-filename-command-execution-via-gksu Exploit
- https://launchpad.net/bugs/1186676 launchpad.net
- https://security.gentoo.org/glsa/201812-10 security.gentoo.org