PT-2014-2138 · Suse · Suse Studio Extension For System Z+2

Thomas Biege · Published 2014-04-16 · Updated 2014-04-17 · CVE-2011-3180

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions kiwi versions prior to 4.98.08 SUSE Studio Onsite versions prior to 1.2.1 SUSE Studio Extension for System z versions prior to 1.2.1

Description The issue allows attackers to execute arbitrary commands via shell metacharacters in the path of an overlay file, related to chown.

Recommendations For kiwi versions prior to 4.98.08, update to version 4.98.08 or later to resolve the issue. For SUSE Studio Onsite versions prior to 1.2.1, update to version 1.2.1 or later. For SUSE Studio Extension for System z versions prior to 1.2.1, update to version 1.2.1 or later.

Exploit

Fix

Related Identifiers

CVE-2011-3180

Affected Products

Suse Studio Extension For System Z

Suse Studio Onsite

Kiwi

References · 4

• 🔥 https://github.com/openSUSE/kiwi/commit/f0f74b3f6ac6d47f7919aa9db380c0ad41ffe55f# · Exploit
• http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00015.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-3180 · Security Note
• http://openwall.com/lists/oss-security/2011/11/02/4 · Note