National Cyber Awareness System

Vulnerability Summary for CVE-2012-3537

Overview

The Crowbar Ohai plugin (chef/cookbooks/ohai/files/default/plugins/crowbar.rb) in the Deployer Barclamp in Crowbar, possibly 1.4 and earlier, allows local users to execute arbitrary shell commands via vectors related to "insecure handling of tmp files" and predictable file names.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: MISC

Name: https://github.com/SUSE-Cloud/barclamp-deployer/commit/b6454268a067fc77ff5de82057b5b53b3cc38b87

Type: Patch Information; Exploit

Hyperlink:https://github.com/SUSE-Cloud/barclamp-deployer/commit/b6454268a067fc77ff5de82057b5b53b3cc38b87

External Source: MISC

Name: https://github.com/SUSE-Cloud/barclamp-deployer/commit/5ea8d4ddaa4cb1ce834d36889f0fe7ac0d617bc8

Type: Patch Information; Exploit

Hyperlink:https://github.com/SUSE-Cloud/barclamp-deployer/commit/5ea8d4ddaa4cb1ce834d36889f0fe7ac0d617bc8

External Source: CONFIRM

Name: https://github.com/dellcloudedge/barclamp-deployer/pull/57

Hyperlink:https://github.com/dellcloudedge/barclamp-deployer/pull/57

External Source: MISC

Name: https://bugzilla.novell.com/show_bug.cgi?id=774967

Hyperlink:https://bugzilla.novell.com/show_bug.cgi?id=774967

External Source: XF

Name: crowbar-privilege-escalation(78041)

Hyperlink:http://xforce.iss.net/xforce/xfdb/78041

External Source: BID

Name: 55240

Hyperlink:http://www.securityfocus.com/bid/55240

External Source: MLIST

Name: [oss-security] 20120827 Re: CVE request: crowbar ohai plugin: local privilege (root) escalation due to insecure tmp file handling

Hyperlink:http://www.openwall.com/lists/oss-security/2012/08/27/7

External Source: MLIST

Name: [oss-security] 20120827 CVE request: crowbar ohai plugin: local privilege (root) escalation due to insecure tmp file handling

Hyperlink:http://www.openwall.com/lists/oss-security/2012/08/27/5

External Source: SECUNIA

Name: 50442

Type: Advisory

Hyperlink:http://secunia.com/advisories/50442

External Source: OSVDB

Name: 84955

Hyperlink:http://osvdb.org/84955