CVE-2011-3211 The server in Bcfg2 1.1.2 and earlier, and 1.2 prerelease, allows remote attackers to execute arbitrary commands via shell metacharacters in data received from a client.
HighCVSS 9.3
EPSS 4.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The server in Bcfg2 1.1.2 and earlier, and 1.2 prerelease, allows remote attackers to execute arbitrary commands via shell metacharacters in data received from a client.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bcfg2 | <= 1.1.2 | No fix listed |
| bcfg2 | = 0.3.1 | No fix listed |
| bcfg2 | = 0.4 | No fix listed |
| bcfg2 | = 0.5 | No fix listed |
| bcfg2 | = 0.6 | No fix listed |
| bcfg2 | = 0.6.1 | No fix listed |
| bcfg2 | = 0.6.3 | No fix listed |
| bcfg2 | = 0.6.4 | No fix listed |
| bcfg2 | = 0.6.5 | No fix listed |
| bcfg2 | = 0.6.6 | No fix listed |
| bcfg2 | = 0.6.7 | No fix listed |
| bcfg2 | = 0.6.8 | No fix listed |
| bcfg2 | = 0.6.9 | No fix listed |
| bcfg2 | = 0.6.10 | No fix listed |
| bcfg2 | = 0.7.0 | No fix listed |
| bcfg2 | = 0.7.1 | No fix listed |
| bcfg2 | = 0.7.2 | No fix listed |
| bcfg2 | = 0.7.3 | No fix listed |
| bcfg2 | = 0.7.4 | No fix listed |
| bcfg2 | = 0.8.0 | No fix listed |
| bcfg2 | = 0.8.1 | No fix listed |
| bcfg2 | = 0.8.2 | No fix listed |
| bcfg2 | = 0.8.3 | No fix listed |
| bcfg2 | = 0.8.4 | No fix listed |
| bcfg2 | = 0.8.5 | No fix listed |
Show 24 more
| Product | Affected versions | Fixed in |
|---|---|---|
| bcfg2 | = 0.8.6.1 | No fix listed |
| bcfg2 | = 0.8.7 | No fix listed |
| bcfg2 | = 0.8.7.1 | No fix listed |
| bcfg2 | = 0.8.7.2 | No fix listed |
| bcfg2 | = 0.9.0 | No fix listed |
| bcfg2 | = 0.9.1d | No fix listed |
| bcfg2 | = 0.9.2 | No fix listed |
| bcfg2 | = 0.9.3 | No fix listed |
| bcfg2 | = 0.9.4 | No fix listed |
| bcfg2 | = 0.9.5 | No fix listed |
| bcfg2 | = 0.9.5.1 | No fix listed |
| bcfg2 | = 0.9.5.2 | No fix listed |
| bcfg2 | = 0.9.5.3 | No fix listed |
| bcfg2 | = 0.9.5.5 | No fix listed |
| bcfg2 | = 0.9.5.7 | No fix listed |
| bcfg2 | = 0.9.6 | No fix listed |
| bcfg2 | = 1.0-pre1 | No fix listed |
| bcfg2 | = 1.0-pre2 | No fix listed |
| bcfg2 | = 1.0-pre4 | No fix listed |
| bcfg2 | = 1.0.0 | No fix listed |
| bcfg2 | = 1.0.1 | No fix listed |
| bcfg2 | = 1.1.0 | No fix listed |
| bcfg2 | = 1.1.1 | No fix listed |
| bcfg2 | = 1.2-prerelease | No fix listed |
References
- [bcfg-dev] 20110816 Security flaw in 1.1.x; testers wanted mailing-list patch
- bugs.debian.org patch
- FEDORA-2011-12303 vendor-advisory
- FEDORA-2011-12298 vendor-advisory
- [oss-security] 20110901 CVE request for bcfg2 (remote root) mailing-list patch
- [oss-security] 20110906 Re: CVE request for bcfg2 (remote root) mailing-list patch
- 45807 third-party-advisory vendor-advisory
- 45926 third-party-advisory vendor-advisory
- 46042 third-party-advisory
- DSA-2302 vendor-advisory
- 49414 vdb-entry
- bugzilla.redhat.com patch
- github.com patch
- github.com patch