SB2012070704 - Fedora EPEL 6 update for bcfg2
Published: July 7, 2012 Updated: April 24, 2025
Security Bulletin ID
SB2012070704
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) OS Command Injection (CVE-ID: CVE-2012-3366)
The vulnerability allows a remote #AU# to execute arbitrary code.
The Trigger plugin in bcfg2 1.2.x before 1.2.3 allows remote attackers with root access to the client to execute arbitrary commands via shell metacharacters in the UUID field to the server process (bcfg2-server).
Remediation
Install update from vendor's website.