CVE-2012-2395 Cobbler subject to Command Injection

High 7.5 Published 16 Jun 2012 Updated 6 Aug 2024

Remote attackers can execute arbitrary commands via shell metacharacters in username or password fields of the Cobbler xmlrpc API.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2012-2395?

CVE-2012-2395 is a high-severity command injection vulnerability in n/a, published on 16 Jun 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Incomplete blacklist vulnerability in action_power.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the power_system method in the xmlrpc API.

Which versions are affected by CVE-2012-2395?

3 open source packages ship an affected version, including cobbler. It affects 1 product.

Package	Affected	Fixed in
`cobbler` PyPI	All versions	`2.6.0`
`cobbler` PyPI	All versions	`2.6.0`
`cobbler` PyPI	All versions	`2.6.0`

Linux distribution packages (2)

`cobbler` Red Hat:network_satellite:5.4::el5	All versions	`0:2.0.7-14.6.el5sat`
`cobbler` Red Hat:network_satellite:5.4::el6	All versions	`0:2.0.7-14.6.el6sat`

Products include Michael Dehaan Cobbler.

How do I fix CVE-2012-2395?

Upgrade cobbler to 2.6.0 or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2012-2395 being exploited?

There is no known exploitation of CVE-2012-2395 in the wild and no public exploit code.

Sources

Also known as GHSA-g34c-mg6m-xvxj, PYSEC-2026-792, RHSA-2012:1060.