Cobbler xmlrpc API power_system Method Remote Shell Command Execution

NASLDB: Cobbler xmlrpc API power_system Method Remote Shell Command Execution

General

ID: 59402
Name: Cobbler xmlrpc API power_system Method Remote Shell Command Execution

Summary: Checks version of Cobbler

Credits: Tenable Network Security, Inc.

Classification

Risk: –

CVSS: –
CVSS Base Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P
CVSS Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Port: –
Family: CGI abuses
Type: Remote

Description

According to its self-reported version, the Cobbler install on the
remote host is affected by a command injection vulnerability that can
be exploited by sending a specially crafted username or password
argument to the ‘power_system’ method.

Successful exploitation requires an authenticated user and xmlrpc API
access.

Exploiting

Exploit Available: False
Exploitability Ease: No known exploits are available

Sources

CVE: CVE-2012-2395
OSVDB: –
Bugtraq: –
scipID: –

Timeline

Vulnerability Disclosure: 2012/04/11
Patch Release: 2012/05/29
Plugin Release: 2012/06/07

Plugin

Version: 1.3
Filename: cobbler_power_command_injection.nasl
Filesize: 4396 bytes
MD5 Hash: 5560d99831d45c2acf3a949988cb2f8e

Identification: –
Require Keys: www/cobbler/xmlrpc", "Settings/ParanoidReport", "www/cobbler_web_admin
Dependencies: "cobbler_admin_detect.nasl", "cobbler_xmlrpc_detect.nasl"

Letzte Plugins

Letzte Plugins

scip AG