CVE-2010-2235:cobbler: template_api.py in Cobbler before 2.0.7, as used in...

VRDA Feed by

Vulnerability Response Decision Assistance Feed : Information for vulnerability impact analysis

[ about VRDA Feed | JPCERT/CC ]

Vulnerability Analysis Result (Revision No : 1)

[ Download XML ]

CVE-2010-2235

cobbler: template_api.py in Cobbler before 2.0.7, as used in...

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-2235

Original

template_api.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute arbitrary code via a crafted kickstart template file, a different vulnerability than CVE-2008-6954.

Translation (Show)

About This Analysis Information

Analysis Information Provider:

NIST NVD

First Published:

2010-12-09

Source Information Category:

Advisory, Alert

Last Updated:

2010-12-10

Affected Product Tags

cpe:/a:michael_dehaan:cobbler:0.1.1.7

cpe:/a:michael_dehaan:cobbler:0.2.1

cpe:/a:michael_dehaan:cobbler:0.2.2

cpe:/a:michael_dehaan:cobbler:0.2.3

cpe:/a:michael_dehaan:cobbler:0.2.5

cpe:/a:michael_dehaan:cobbler:0.2.7

cpe:/a:michael_dehaan:cobbler:0.2.8

cpe:/a:michael_dehaan:cobbler:0.2.9

cpe:/a:michael_dehaan:cobbler:0.3.0

cpe:/a:michael_dehaan:cobbler:0.3.1

cpe:/a:michael_dehaan:cobbler:0.3.3

cpe:/a:michael_dehaan:cobbler:0.3.4

cpe:/a:michael_dehaan:cobbler:0.3.5

cpe:/a:michael_dehaan:cobbler:0.3.6

cpe:/a:michael_dehaan:cobbler:0.3.7

cpe:/a:michael_dehaan:cobbler:0.3.9

cpe:/a:michael_dehaan:cobbler:0.4.0

cpe:/a:michael_dehaan:cobbler:0.4.2

cpe:/a:michael_dehaan:cobbler:0.4.3

cpe:/a:michael_dehaan:cobbler:0.4.5

cpe:/a:michael_dehaan:cobbler:0.4.6

cpe:/a:michael_dehaan:cobbler:0.4.7

cpe:/a:michael_dehaan:cobbler:0.4.8

cpe:/a:michael_dehaan:cobbler:0.5.0

cpe:/a:michael_dehaan:cobbler:0.6.0

cpe:/a:michael_dehaan:cobbler:0.6.1

cpe:/a:michael_dehaan:cobbler:0.6.3

cpe:/a:michael_dehaan:cobbler:0.6.4

cpe:/a:michael_dehaan:cobbler:0.6.5

cpe:/a:michael_dehaan:cobbler:0.8.1

cpe:/a:michael_dehaan:cobbler:0.8.3

cpe:/a:michael_dehaan:cobbler:1.0.0

cpe:/a:michael_dehaan:cobbler:1.0.2

cpe:/a:michael_dehaan:cobbler:1.0.2-1

cpe:/a:michael_dehaan:cobbler:1.0.3-1

cpe:/a:michael_dehaan:cobbler:1.2.0

cpe:/a:michael_dehaan:cobbler:1.2.2

cpe:/a:michael_dehaan:cobbler:1.2.3

cpe:/a:michael_dehaan:cobbler:1.2.5

cpe:/a:michael_dehaan:cobbler:1.2.6

cpe:/a:michael_dehaan:cobbler:1.2.7

cpe:/a:michael_dehaan:cobbler:1.2.8

cpe:/a:michael_dehaan:cobbler:1.2.8-1

cpe:/a:michael_dehaan:cobbler:1.2.9

cpe:/a:michael_dehaan:cobbler:1.2.9-1

cpe:/a:michael_dehaan:cobbler:1.3.1

cpe:/a:michael_dehaan:cobbler:1.3.1-1

cpe:/a:michael_dehaan:cobbler:1.3.3

cpe:/a:michael_dehaan:cobbler:1.3.3-1

cpe:/a:michael_dehaan:cobbler:1.3.4

cpe:/a:michael_dehaan:cobbler:1.3.4-1

cpe:/a:michael_dehaan:cobbler:1.4.0

cpe:/a:michael_dehaan:cobbler:1.4.0-2

cpe:/a:michael_dehaan:cobbler:1.4.1

cpe:/a:michael_dehaan:cobbler:1.4.1-1

cpe:/a:michael_dehaan:cobbler:1.4.2

cpe:/a:michael_dehaan:cobbler:1.4.2-1

cpe:/a:michael_dehaan:cobbler:1.4.3

cpe:/a:michael_dehaan:cobbler:1.4.3-4

cpe:/a:michael_dehaan:cobbler:1.6.1

cpe:/a:michael_dehaan:cobbler:1.6.1-1

cpe:/a:michael_dehaan:cobbler:1.6.2

cpe:/a:michael_dehaan:cobbler:1.6.2-1

cpe:/a:michael_dehaan:cobbler:1.6.3

cpe:/a:michael_dehaan:cobbler:1.6.3-1

cpe:/a:michael_dehaan:cobbler:1.6.4

cpe:/a:michael_dehaan:cobbler:1.6.4-1

cpe:/a:michael_dehaan:cobbler:1.6.5

cpe:/a:michael_dehaan:cobbler:1.6.5-1

cpe:/a:michael_dehaan:cobbler:1.6.6

cpe:/a:michael_dehaan:cobbler:1.6.6-1

cpe:/a:michael_dehaan:cobbler:1.6.8

cpe:/a:michael_dehaan:cobbler:1.6.8-1

cpe:/a:michael_dehaan:cobbler:2.0.0

cpe:/a:michael_dehaan:cobbler:2.0.0-1

cpe:/a:michael_dehaan:cobbler:2.0.1

cpe:/a:michael_dehaan:cobbler:2.0.1-1

cpe:/a:michael_dehaan:cobbler:2.0.3

cpe:/a:michael_dehaan:cobbler:2.0.3.1

cpe:/a:michael_dehaan:cobbler:2.0.3.1-2

cpe:/a:michael_dehaan:cobbler:2.0.4 and previous versions

cpe:/a:michael_dehaan:cobbler:2.0.4-1

Vulnerability Analysis Results

[Access Vector] ^[?]

Undefined^[?]

Local^[?]

Adjacent Network^[?]

Network^[?]

[Access Complexit] ^[?]

Undefined^[?]

High^[?]

Medium^[?]

Low^[?]

[Authentication] ^[?]

Undefined^[?]

Multiple^[?]

Single^[?]

None^[?]

[Confidentiality Impact] ^[?]

Undefined^[?]

None^[?]

Partial^[?]

Complete^[?]

[Integrity Impact] ^[?]

Undefined^[?]

None^[?]

Partial^[?]

Complete^[?]

[Availability Impact] ^[?]

Undefined^[?]

None^[?]

Partial^[?]

Complete^[?]

Alternatives

References

CONFIRM http://people.fedoraproject.org/~shenson/cobbler/cobbler-2.0.8.tar.gz

CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=607662

REDHAT RHSA-2010:0775

Vulnerability Type Code Injection (CWE-94)