PT-2009-2423 · Cobbler+1 · Cobblerweb+2

Published 2009-08-12 · Updated 2022-05-17 · CVE-2008-6954

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Cobbler versions prior to 1.2.9

Description: The issue allows remote authenticated users to execute arbitrary Python code with root privileges in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules. This can be done through the web interface, CobblerWeb.

Recommendations: For versions prior to 1.2.9, update to version 1.2.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the Cheetah kickstart template editing feature in CobblerWeb to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

CWE-264

Related Identifiers

CVE-2008-6954

GHSA-P8W2-F44P-FMCJ

Affected Products

Cheetah

Cobbler

Cobblerweb

References · 14

• http://freshmeat.net/projects/cobbler/releases/288374 · Patch
• http://secunia.com/advisories/32804 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-November/msg00462.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-6954 · Security Note
• https://redhat.com/archives/fedora-package-announce/2008-November/msg00485.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p8w2-f44p-fmcj · Vendor Advisory
• http://securityfocus.com/bid/32317 · Patch
• http://secunia.com/advisories/32737 · Vendor Advisory
• https://github.com/cobbler/cobbler · Note
• http://osvdb.org/50291 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46625 · Note
• https://web.archive.org/web/20200228143518/http://securityfocus.com/bid/32317 · Note
• https://web.archive.org/web/20111227125913/http://secunia.com/advisories/32804 · Note
• https://web.archive.org/web/20111227151912/http://secunia.com/advisories/32737 · Note