Cobbler Web Interface Kickstart Template Remote Privilege Escalation Vulnerability

Bugtraq ID:	32317
Class:	Input Validation Error
CVE:	CVE-2008-6954
Remote:	Yes
Local:	No
Published:	Nov 15 2008 12:00AM
Updated:	May 07 2015 05:21PM
Credit:	Cobbler
Vulnerable:	Cobbler Project Cobbler 1.2.8 1
Not Vulnerable:	Cobbler Project Cobbler 1.2.9

Cobbler Web Interface Kickstart Template Remote Privilege Escalation Vulnerability

The web interface of Cobbler is prone to a remote privilege-escalation vulnerability.

Remote attackers who can edit kickstart templates may exploit this issue to execute arbitrary Python code with root privileges. Successfully exploiting this issue may compromise the affected computer.

Versions prior to Cobbler 1.2.9 are affected.

Cobbler Web Interface Kickstart Template Remote Privilege Escalation Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Cobbler Web Interface Kickstart Template Remote Privilege Escalation Vulnerability

Solution:
The vendor has released an update. Please see the references for more information.


Cobbler Project Cobbler 1.2.8 1

• Cobbler cobbler-1.2.9.tar.gz
  http://freshmeat.net/redir/cobbler/66473/url_tgz/cobbler-1.2.9.tar.gz

Cobbler Web Interface Kickstart Template Remote Privilege Escalation Vulnerability

References:

• Cobbler Homepage (Cobbler)