Security update for cifs-utils SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:2728-1 Final 1 1 2020-09-23T14:00:23Z current 2020-09-23T14:00:23Z 2020-09-23T14:00:23Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for cifs-utils This update for cifs-utils fixes the following issues: - CVE-2020-14342: Fixed a shell command injection vulnerability in mount.cifs (bsc#1174477). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES12-SP4-Azure-BYOS-2020-2728,Image SLES12-SP4-EC2-HVM-BYOS-2020-2728,Image SLES12-SP4-GCE-BYOS-2020-2728,Image SLES12-SP4-OCI-BYOS-2020-2728,Image SLES12-SP4-SAP-Azure-2020-2728,Image SLES12-SP4-SAP-Azure-BYOS-2020-2728,Image SLES12-SP4-SAP-Azure-LI-BYOS-Production-2020-2728,Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production-2020-2728,Image SLES12-SP4-SAP-EC2-HVM-2020-2728,Image SLES12-SP4-SAP-EC2-HVM-BYOS-2020-2728,Image SLES12-SP4-SAP-GCE-2020-2728,Image SLES12-SP4-SAP-GCE-BYOS-2020-2728,Image SLES12-SP4-SAP-OCI-BYOS-2020-2728,Image SLES12-SP5-Azure-BYOS-2020-2728,Image SLES12-SP5-Azure-Basic-On-Demand-2020-2728,Image SLES12-SP5-Azure-HPC-BYOS-2020-2728,Image SLES12-SP5-Azure-HPC-On-Demand-2020-2728,Image SLES12-SP5-Azure-SAP-BYOS-2020-2728,Image SLES12-SP5-Azure-SAP-On-Demand-2020-2728,Image SLES12-SP5-Azure-Standard-On-Demand-2020-2728,Image SLES12-SP5-EC2-BYOS-2020-2728,Image SLES12-SP5-EC2-ECS-On-Demand-2020-2728,Image SLES12-SP5-EC2-On-Demand-2020-2728,Image SLES12-SP5-EC2-SAP-BYOS-2020-2728,Image SLES12-SP5-EC2-SAP-On-Demand-2020-2728,Image SLES12-SP5-GCE-BYOS-2020-2728,Image SLES12-SP5-GCE-On-Demand-2020-2728,Image SLES12-SP5-GCE-SAP-BYOS-2020-2728,Image SLES12-SP5-GCE-SAP-On-Demand-2020-2728,Image SLES12-SP5-OCI-BYOS-BYOS-2020-2728,Image SLES12-SP5-OCI-BYOS-SAP-BYOS-2020-2728,Image SLES12-SP5-SAP-Azure-LI-BYOS-Production-2020-2728,Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production-2020-2728,SUSE-2020-2728,SUSE-SLE-SDK-12-SP5-2020-2728,SUSE-SLE-SERVER-12-SP5-2020-2728 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20202728-1/ Link for SUSE-SU-2020:2728-1 https://lists.suse.com/pipermail/sle-security-updates/2020-September/007474.html E-Mail link for SUSE-SU-2020:2728-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1174477 SUSE Bug 1174477 https://www.suse.com/security/cve/CVE-2020-14342/ SUSE CVE CVE-2020-14342 page Image SLES12-SP4-Azure-BYOS Image SLES12-SP4-EC2-HVM-BYOS Image SLES12-SP4-GCE-BYOS Image SLES12-SP4-OCI-BYOS Image SLES12-SP4-SAP-Azure Image SLES12-SP4-SAP-Azure-BYOS Image SLES12-SP4-SAP-Azure-LI-BYOS-Production Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production Image SLES12-SP4-SAP-EC2-HVM Image SLES12-SP4-SAP-EC2-HVM-BYOS Image SLES12-SP4-SAP-GCE Image SLES12-SP4-SAP-GCE-BYOS Image SLES12-SP4-SAP-OCI-BYOS Image SLES12-SP5-Azure-BYOS Image SLES12-SP5-Azure-Basic-On-Demand Image SLES12-SP5-Azure-HPC-BYOS Image SLES12-SP5-Azure-HPC-On-Demand Image SLES12-SP5-Azure-SAP-BYOS Image SLES12-SP5-Azure-SAP-On-Demand Image SLES12-SP5-Azure-Standard-On-Demand Image SLES12-SP5-EC2-BYOS Image SLES12-SP5-EC2-ECS-On-Demand Image SLES12-SP5-EC2-On-Demand Image SLES12-SP5-EC2-SAP-BYOS Image SLES12-SP5-EC2-SAP-On-Demand Image SLES12-SP5-GCE-BYOS Image SLES12-SP5-GCE-On-Demand Image SLES12-SP5-GCE-SAP-BYOS Image SLES12-SP5-GCE-SAP-On-Demand Image SLES12-SP5-OCI-BYOS-BYOS Image SLES12-SP5-OCI-BYOS-SAP-BYOS Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 cifs-utils-6.9-13.11.1 cifs-utils-devel-6.9-13.11.1 pam_cifscreds-6.9-13.11.1 cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP4-Azure-BYOS cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP4-EC2-HVM-BYOS cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP4-GCE-BYOS cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP4-OCI-BYOS cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP4-SAP-Azure cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP4-SAP-Azure-BYOS cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP4-SAP-Azure-LI-BYOS-Production cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP4-SAP-EC2-HVM cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP4-SAP-EC2-HVM-BYOS cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP4-SAP-GCE cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP4-SAP-GCE-BYOS cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP4-SAP-OCI-BYOS cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP5-Azure-BYOS cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP5-Azure-Basic-On-Demand cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP5-Azure-HPC-BYOS cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP5-Azure-HPC-On-Demand cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP5-Azure-SAP-On-Demand cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP5-Azure-Standard-On-Demand cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP5-EC2-BYOS cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP5-EC2-ECS-On-Demand cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP5-EC2-On-Demand cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP5-GCE-BYOS cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP5-GCE-On-Demand cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP5-GCE-SAP-BYOS cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP5-GCE-SAP-On-Demand cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP5-OCI-BYOS-BYOS cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP5-OCI-BYOS-SAP-BYOS cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP5-SAP-Azure-LI-BYOS-Production cifs-utils-6.9-13.11.1 as a component of Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production cifs-utils-6.9-13.11.1 as a component of SUSE Linux Enterprise Server 12 SP5 cifs-utils-6.9-13.11.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 cifs-utils-devel-6.9-13.11.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges. CVE-2020-14342 Image SLES12-SP4-Azure-BYOS:cifs-utils-6.9-13.11.1 Image SLES12-SP4-EC2-HVM-BYOS:cifs-utils-6.9-13.11.1 Image SLES12-SP4-GCE-BYOS:cifs-utils-6.9-13.11.1 Image SLES12-SP4-OCI-BYOS:cifs-utils-6.9-13.11.1 Image SLES12-SP4-SAP-Azure-BYOS:cifs-utils-6.9-13.11.1 Image SLES12-SP4-SAP-Azure-LI-BYOS-Production:cifs-utils-6.9-13.11.1 Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production:cifs-utils-6.9-13.11.1 Image SLES12-SP4-SAP-Azure:cifs-utils-6.9-13.11.1 Image SLES12-SP4-SAP-EC2-HVM-BYOS:cifs-utils-6.9-13.11.1 Image SLES12-SP4-SAP-EC2-HVM:cifs-utils-6.9-13.11.1 Image SLES12-SP4-SAP-GCE-BYOS:cifs-utils-6.9-13.11.1 Image SLES12-SP4-SAP-GCE:cifs-utils-6.9-13.11.1 Image SLES12-SP4-SAP-OCI-BYOS:cifs-utils-6.9-13.11.1 Image SLES12-SP5-Azure-BYOS:cifs-utils-6.9-13.11.1 Image SLES12-SP5-Azure-Basic-On-Demand:cifs-utils-6.9-13.11.1 Image SLES12-SP5-Azure-HPC-BYOS:cifs-utils-6.9-13.11.1 Image SLES12-SP5-Azure-HPC-On-Demand:cifs-utils-6.9-13.11.1 Image SLES12-SP5-Azure-SAP-BYOS:cifs-utils-6.9-13.11.1 Image SLES12-SP5-Azure-SAP-On-Demand:cifs-utils-6.9-13.11.1 Image SLES12-SP5-Azure-Standard-On-Demand:cifs-utils-6.9-13.11.1 Image SLES12-SP5-EC2-BYOS:cifs-utils-6.9-13.11.1 Image SLES12-SP5-EC2-ECS-On-Demand:cifs-utils-6.9-13.11.1 Image SLES12-SP5-EC2-On-Demand:cifs-utils-6.9-13.11.1 Image SLES12-SP5-EC2-SAP-BYOS:cifs-utils-6.9-13.11.1 Image SLES12-SP5-EC2-SAP-On-Demand:cifs-utils-6.9-13.11.1 Image SLES12-SP5-GCE-BYOS:cifs-utils-6.9-13.11.1 Image SLES12-SP5-GCE-On-Demand:cifs-utils-6.9-13.11.1 Image SLES12-SP5-GCE-SAP-BYOS:cifs-utils-6.9-13.11.1 Image SLES12-SP5-GCE-SAP-On-Demand:cifs-utils-6.9-13.11.1 Image SLES12-SP5-OCI-BYOS-BYOS:cifs-utils-6.9-13.11.1 Image SLES12-SP5-OCI-BYOS-SAP-BYOS:cifs-utils-6.9-13.11.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:cifs-utils-6.9-13.11.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:cifs-utils-6.9-13.11.1 SUSE Linux Enterprise Server 12 SP5:cifs-utils-6.9-13.11.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:cifs-utils-6.9-13.11.1 SUSE Linux Enterprise Software Development Kit 12 SP5:cifs-utils-devel-6.9-13.11.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20202728-1/ https://www.suse.com/security/cve/CVE-2020-14342.html CVE-2020-14342 https://bugzilla.suse.com/1174477 SUSE Bug 1174477