CVE-2020-27187

High

Description

An issue was discovered in KDE Partition Manager 4.1.0 before 4.2.0. The kpmcore_externalcommand helper contains a logic flaw in which the service invoking D-Bus is not properly checked. An attacker on the local machine can replace /etc/fstab, and execute mount and other partitioning related commands, while KDE Partition Manager is running. the mount command can then be used to gain full root privileges.

SeverityHigh

CVSS7.8

Exploit probability—

ProductKde Partition Manager

PublishedOct 26, 2020

First seenOct 26, 2020

How to fix

Update

kde partition_manager4.2.0 or later

Vendor advisories

security.gentoo.org/glsa/202011-03

Affected products

Product	Affected versions	Fixed in
kde partition_manager	4.1.0 ≤ v < 4.2.0	4.2.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.