Shell Command Injection Vulnerability in KDE Plasma Workspace
CVE-2018-6791

6.8MEDIUM

Key Information:

Vendor: Kde
Status: Plasma-workspace
Vendor: CVE Published:; 7 February 2018

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2018-6791?

A command injection issue was identified in the KDE Plasma Workspace, specifically within the device service management component. When a vfat thumbdrive with a specially crafted volume label (including characters such as `` or $()) is mounted, the system interprets this as a shell command. This unexpected behavior can lead to the execution of arbitrary commands, potentially compromising the system's security. For instance, a volume label like '$(touch b)' could create an unwanted file in the user's home directory. Users are advised to upgrade to KDE Plasma Workspace version 5.12.0 or later to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

KDE_Vuln
Created by rarar0