CVE-2018-20106 - OpenCVE

In yast2-printer up to and including version 4.0.2 the SMB printer settings don't escape characters in passwords properly. If a password with backticks or simliar characters is supplied this allows for executing code as root. This requires tricking root to enter such a password in yast.

No CVSS v3.1

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

AV:N/AC:M/Au:N/C:C/I:C/A:C

Vendors & Products
CPE Configurations

Vendors	Products
Opensuse	Yast2-printer

Configuration 1 [-]

cpe:2.3:a:opensuse:yast2-printer:*:*:*:*:*:*:*:*

References

Link	Resource
https://bugzilla.suse.com/show_bug.cgi?id=1114853

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: microfocus

Published: 2018-11-06T00:00:00

Updated: 2021-01-06T16:15:50

Reserved: 2018-12-12T00:00:00

Link: CVE-2018-20106

JSON object: View

NVD Information

Status : Modified

Published: 2019-03-15T20:29:00.730

Modified: 2023-11-07T02:56:12.403

Link: CVE-2018-20106

JSON object: View

Redhat Information

No data.

CWE

{"containers": {"cna": {"affected": [{"product": "yast2-printer", "vendor": "SUSE", "versions": [{"lessThanOrEqual": "4.0.2", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": " Dainius Masiliunas"}], "datePublic": "2018-11-06T00:00:00", "descriptions": [{"lang": "en", "value": "In yast2-printer up to and including version 4.0.2 the SMB printer settings don't escape characters in passwords properly. If a password with backticks or simliar characters is supplied this allows for executing code as root. This requires tricking root to enter such a password in yast."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "description": "CWE-78", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-01-06T16:15:50", "orgId": "f81092c5-7f14-476d-80dc-24857f90be84", "shortName": "microfocus"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1114853"}], "source": {"advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1114853", "defect": ["1114853"], "discovery": "USER"}, "title": "SMB printer settings don't escape characters in passwords properly", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@microfocus.com", "DATE_PUBLIC": "2018-11-06T00:00:00.000Z", "ID": "CVE-2018-20106", "STATE": "PUBLIC", "TITLE": "SMB printer settings don't escape characters in passwords properly"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "yast2-printer", "version": {"version_data": [{"affected": "<=", "version_affected": "<=", "version_value": "4.0.2"}]}}]}, "vendor_name": "SUSE"}]}}, "credit": [{"lang": "eng", "value": " Dainius Masiliunas"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In yast2-printer up to and including version 4.0.2 the SMB printer settings don't escape characters in passwords properly. If a password with backticks or simliar characters is supplied this allows for executing code as root. This requires tricking root to enter such a password in yast."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-78"}]}]}, "references": {"reference_data": [{"name": "https://bugzilla.suse.com/show_bug.cgi?id=1114853", "refsource": "CONFIRM", "url": "https://bugzilla.suse.com/show_bug.cgi?id=1114853"}]}, "source": {"advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1114853", "defect": ["1114853"], "discovery": "USER"}}}}, "cveMetadata": {"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84", "assignerShortName": "microfocus", "cveId": "CVE-2018-20106", "datePublished": "2018-11-06T00:00:00", "dateReserved": "2018-12-12T00:00:00", "dateUpdated": "2021-01-06T16:15:50", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:opensuse:yast2-printer:*:*:*:*:*:*:*:*", "matchCriteriaId": "08E89D79-9153-40A9-838B-FBDA6EC2039D", "versionEndIncluding": "4.0.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "In yast2-printer up to and including version 4.0.2 the SMB printer settings don't escape characters in passwords properly. If a password with backticks or simliar characters is supplied this allows for executing code as root. This requires tricking root to enter such a password in yast."}, {"lang": "es", "value": "En yast2-printer, en versiones hasta e incluyendo la 4.0.2, las opciones de la impresora SMB no escapan las contrase\u00f1as adecuadamente. Si se proporciona una contrase\u00f1a con comillas hacia atr\u00e1s o similares, se puede ejecutar c\u00f3digo como root. Esto requiere enga\u00f1ar al root para que introduzca tal contrase\u00f1a en yast."}], "id": "CVE-2018-20106", "lastModified": "2023-11-07T02:56:12.403", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 0.6, "impactScore": 5.9, "source": "security@opentext.com", "type": "Secondary"}]}, "published": "2019-03-15T20:29:00.730", "references": [{"source": "security@opentext.com", "url": "https://bugzilla.suse.com/show_bug.cgi?id=1114853"}], "sourceIdentifier": "security@opentext.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-78"}], "source": "security@opentext.com", "type": "Secondary"}]}