CVE-2014-2886

Name	CVE-2014-2886
Description	GKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters in a gksu-run-helper argument, which allows attackers to execute arbitrary commands in certain situations involving an untrusted substring within this argument, as demonstrated by an untrusted filename encountered during installation of a VirtualBox extension pack.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
gksu	source	(unstable)	(unfixed)

Notes

[stretch] - gksu <ignored> (Minor issue)
[jessie] - gksu <ignored> (Minor issue)
[wheezy] - gksu <no-dsa> (Minor issue)
[squeeze] - gksu <no-dsa> (Minor issue)
https://community.rapid7.com/community/metasploit/blog/2014/07/07/virtualbox-filename-command-execution-via-gksu
In Debian libgksu installs two alternatives gconf-defaults.libgksu-sudo
and gconf-defaults.libgksu-su, where the gconf-defaults.libgksu-su is
enabled (in auto mode).