PT-2009-2423 · Cobbler+1 · Cobblerweb+2

Publicado 2009-08-12 · Atualizado 2022-05-17 · CVE-2008-6954

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Cobbler versions prior to 1.2.9

Description: The issue allows remote authenticated users to execute arbitrary Python code with root privileges in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules. This can be done through the web interface, CobblerWeb.

Recommendations: For versions prior to 1.2.9, update to version 1.2.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the Cheetah kickstart template editing feature in CobblerWeb to minimize the risk of exploitation.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

CWE-264

Identificadores relacionados

CVE-2008-6954

GHSA-P8W2-F44P-FMCJ

Produtos afetados

Cheetah

Cobbler

Cobblerweb

Referências · 14

• https://github.com/cobbler/cobbler · Nota
• http://osvdb.org/50291 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46625 · Nota
• http://freshmeat.net/projects/cobbler/releases/288374 · Correção
• https://web.archive.org/web/20200228143518/http://securityfocus.com/bid/32317 · Nota
• http://secunia.com/advisories/32804 · Aviso do Fabricante
• https://redhat.com/archives/fedora-package-announce/2008-November/msg00462.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-6954 · Nota de Segurança
• https://redhat.com/archives/fedora-package-announce/2008-November/msg00485.html · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-p8w2-f44p-fmcj · Aviso do Fabricante
• https://web.archive.org/web/20111227125913/http://secunia.com/advisories/32804 · Nota
• http://securityfocus.com/bid/32317 · Correção
• https://web.archive.org/web/20111227151912/http://secunia.com/advisories/32737 · Nota
• http://secunia.com/advisories/32737 · Aviso do Fabricante