CVE-2012-3366 The Trigger plugin in bcfg2 1.2.x before 1.2.3 allows remote attackers with root access to the client to execute arbitrary commands via shell metacharacters in the UUID field to the server process (bc...
HighCVSS 9.0
EPSS 3.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Trigger plugin in bcfg2 1.2.x before 1.2.3 allows remote attackers with root access to the client to execute arbitrary commands via shell metacharacters in the UUID field to the server process (bcfg2-server).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| anl bcfg2 | = 1.2.0 | No fix listed |
| anl bcfg2 | = 1.2.0-rc2 | No fix listed |
References
- [bcfg-dev] 20120612 Major security flaw in Trigger plugin mailing-list
- 49629 third-party-advisory vendor-advisory
- 49690 third-party-advisory vendor-advisory
- DSA-2503 vendor-advisory
- 54217 vdb-entry
- bcfg2-trigger-command-execution(76616) vdb-entry
- github.com patch