Vulnerability CVE-2008-6954 - CERT Civis.Net

Vulnerability Name:

CVE-2008-6954 (CCN-46625)

Assigned:

2008-11-15

Published:

2008-11-15

Updated:

2017-08-17

Summary:

The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.

CVSS v3 Severity:

8.0 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): Low User Interaction (UI): Required
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

9.0 High (CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C)
6.7 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

8.5 High (CCN CVSS v2 Vector: AV:N/AC:M/Au:S/C:C/I:C/A:C)
6.3 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:S/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Gain Privileges

References:

Source: MITRE
Type: CNA
CVE-2008-6954

Source: CCN
Type: freshmeat Web site
Cobbler 1.2.9 (Default)

Source: CONFIRM
Type: Patch
http://freshmeat.net/projects/cobbler/releases/288374

Source: OSVDB
Type: UNKNOWN
50291

Source: CCN
Type: SA32737
Cobbler Web Interface Privilege Escalation Vulnerability

Source: SECUNIA
Type: Vendor Advisory
32737

Source: SECUNIA
Type: Vendor Advisory
32804

Source: CCN
Type: OSVDB ID: 50291
Cobbler Web Interface Kickstart Template Manipulation Privilege Escalation

Source: BID
Type: Patch
32317

Source: CCN
Type: BID-32317
Cobbler Web Interface Kickstart Template Remote Privilege Escalation Vulnerability

Source: XF
Type: UNKNOWN
cobbler-interface-code-execution(46625)

Source: XF
Type: UNKNOWN
cobbler-interface-code-execution(46625)

Source: CCN
Type: Cobbler Web page
Cobbler

Source: FEDORA
Type: UNKNOWN
FEDORA-2008-9723

Source: FEDORA
Type: UNKNOWN
FEDORA-2008-9745

Vulnerable Configuration:

Configuration 1:

cpe:/a:michael_dehaan:cobbler:0.1.1.7:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.2.1:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.2.2:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.2.3:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.2.5:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.2.7:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.2.8:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.2.9:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.3.0:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.3.1:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.3.3:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.3.4:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.3.5:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.3.6:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.3.7:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.3.9:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.4.0:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.4.2:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.4.3:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.4.5:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.4.6:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.4.7:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.4.8:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.5.0:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.6.0:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.6.1:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.6.3:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.6.4:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.6.5:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.8.1:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.8.3:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:1.0.0:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:1.0.2:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:1.0.2-1:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:1.0.3-1:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:1.2.0:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:1.2.2:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:1.2.3:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:1.2.5:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:1.2.6:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:1.2.7:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:*:*:*:*:*:*:*:* (Version <= 1.2.8)

Configuration CCN 1:

cpe:/a:michael_dehaan:cobbler:1.2.8:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:1.2.7:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:1.2.6:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:1.2.5:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:1.2.3:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:1.2.2:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:1.2.0:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:1.0.3-1:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:1.0.2:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:1.0.2-1:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:1.0.0:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.8.3:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.8.1:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.6.5:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.6.4:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.6.3:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.6.1:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.6.0:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.5.0:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.4.8:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.4.7:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.4.6:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.4.5:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.4.3:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.4.2:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.4.0:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.3.9:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.3.7:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.3.6:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.3.5:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.3.4:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.3.3:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.3.1:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.3.0:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.2.9:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.2.8:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.2.7:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.2.5:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.2.3:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.2.2:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.2.1:*:*:*:*:*:*:*

OR cpe:/a:michael_dehaan:cobbler:0.1.1.7:*:*:*:*:*:*:*

Denotes that component is vulnerable