Cobbler Kickstart Template Remote Privilege Escalation Vulnerability

Bugtraq ID:	44174
Class:	Input Validation Error
CVE:	CVE-2010-2235
Remote:	Yes
Local:	No
Published:	Oct 18 2010 12:00AM
Updated:	Oct 18 2010 12:00AM
Credit:	Jan Lieskovsky
Vulnerable:	Red Hat Network Satellite Server (for RHEL 5) 5.3 Red Hat Network Satellite Server (for RHEL 4) 5.3 Cobbler Cobbler 0
Not Vulnerable:

Cobbler Kickstart Template Remote Privilege Escalation Vulnerability

Cobbler is prone to a remote privilege-escalation vulnerability.

Remote attackers who can edit kickstart templates may exploit this issue to execute arbitrary Python code with root privileges. Successfully exploiting this issue may compromise the affected computer.

Cobbler Kickstart Template Remote Privilege Escalation Vulnerability

Attackers require the 'Configuration Administrator role' privilege to exploit this issue.

Cobbler Kickstart Template Remote Privilege Escalation Vulnerability

Solution:
Updates are available. Please see the references for more information.

Cobbler Kickstart Template Remote Privilege Escalation Vulnerability

References:

• Cobbler code injection vulnerability (Red Hat Bugzilla- Bug 607662 )
  
• Cobbler Homepage (Cobbler)