CVE-2012-3366

Published: Jul 3, 2012Modified: Apr 29, 2026

9.0

Vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Exploitability: 8.0 / Impact: 10.0

Source: NVD

Description

The Trigger plugin in bcfg2 1.2.x before 1.2.3 allows remote attackers with root access to the client to execute arbitrary commands via shell metacharacters in the UUID field to the server process (bcfg2-server).

Affected (2)

Products: Anl: Bcfg2

Anl

1 product

Bcfg2

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Anl Bcfg2	Version 1.2.0
Anl Bcfg2	Version 1.2.0 rc2

Related CWEs

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (14)

http://permalink.gmane.org/gmane.comp.sysutils.bcfg2.devel/4539

Source: secalert@redhat.com

http://secunia.com/advisories/49629

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/49690

Source: secalert@redhat.com

Vendor Advisory

http://www.debian.org/security/2012/dsa-2503

Source: secalert@redhat.com

http://www.securityfocus.com/bid/54217

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/76616

Source: secalert@redhat.com

https://github.com/Bcfg2/bcfg2/commit/a524967e8d5c4c22e49cd619aed20c87a316c0be

Source: secalert@redhat.com

Patch

http://permalink.gmane.org/gmane.comp.sysutils.bcfg2.devel/4539