PT-2014-2167 · Suse · Suse Studio Extension For System Z+2

Thomas Biege · Published 2014-04-16 · Updated 2014-04-17 · CVE-2011-4195

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SUSE Studio Onsite versions 1.2 through 1.2 before 1.2.1 SUSE Studio Extension for System z versions 1.2 through 1.2 before 1.2.1 kiwi versions prior to 4.98.05

Description The issue allows attackers to execute arbitrary commands via shell metacharacters in an image name.

Recommendations For SUSE Studio Onsite version 1.2, update to version 1.2.1. For SUSE Studio Extension for System z version 1.2, update to version 1.2.1. For kiwi versions prior to 4.98.05, update to version 4.98.05 or later.

Exploit

Fix

Related Identifiers

CVE-2011-4195

Affected Products

Suse Studio Extension For System Z

Suse Studio Onsite

Kiwi

References · 4

• 🔥 https://github.com/openSUSE/kiwi/commit/88bf491d16942766016c606e4210b4e072c1019f · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-4195 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00015.html · Vendor Advisory
• http://openwall.com/lists/oss-security/2011/11/02/4 · Note