An issue was discovered in soliduiserver/deviceserviceaction.cpp in KDE Plasma Workspace before 5.12.0. When a vfat thumbdrive that contains `` or $() in its volume label is plugged in and mounted through the device notifier, it's interpreted as a shell command, leading to a possibility of arbitrary command execution. An example of an offending volume label is "$(touch b)" -- this will create a file called b in the home folder.

The remote host is affected by the vulnerability described in GLSA-201803-09 (KDE Plasma Workspaces: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in KDE Plasma Workspaces.
      Please review the referenced CVE identifiers for details.
  Impact :

    An attacker could execute arbitrary commands via specially crafted thumb       drive&rsquo;s volume labels or obtain sensitive information via specially       crafted notifications.
  Workaround :

    Users should mount removable devices with Dolphin instead of the device       notifier.
    Users should disable notifications.

Fix for CVE-2018-6790 CVE-2018-6791, backport crashfix for xembedsniproxy

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Krzysztof Sieluzycki discovered that the notifier for removable devices in the KDE Plasma workspace performed insufficient sanitisation of FAT/VFAT volume labels, which could result in the execution of arbitrary shell commands if a removable device with a malformed disk label is mounted.

Fix for CVE-2018-6790 CVE-2018-6791

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for plasma5-workspace fixes security issues and bugs.

The following vulnerabilities were fixed :

  - CVE-2018-6790: Desktop notifications could have been     used to load arbitrary remote images into Plasma,     allowing for client IP discovery (boo#1079429)

  - CVE-2018-6791: A specially crafted file system label may     have allowed execution of arbitrary code (boo#1079751)

The following bugs were fixed :

  - Plasma could freeze with certain notifications     (boo#1013550)

ID	Name	Product	Family	Severity
108435	GLSA-201803-09 : KDE Plasma Workspaces: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
106907	Fedora 26 : plasma-workspace (2018-337757e11f)	Nessus	Fedora Local Security Checks	medium
106874	Debian DSA-4116-1 : plasma-workspace - security update	Nessus	Debian Local Security Checks	medium
106784	Fedora 27 : plasma-workspace (2018-fa58e0c507)	Nessus	Fedora Local Security Checks	medium
106702	openSUSE Security Update : plasma5-workspace (openSUSE-2018-147)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2018-6791

medium

Tenable Plugins

medium

medium

medium

medium

medium