Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 27 Jun 2012 12:32:22 -0600
From: Vincent Danen <>
Subject: CVE request: arbitrary code exec in bcfg2

bcfg2 suffers from an arbitrary code execution flaw due to the Trigger
plugin.  Upstream has corrected the issue in git, but no released
packages are available and it looks like this has been around for a
while (indicated that 1.x is affected as well, up to and including the
current 1.2.2 release).

Looks like an authenticated remote root compromise (need to be able to
log into bcfg2 to exploit it, and bcfg2 typically runs as root).

Could a CVE be assigned to this please?



Vincent Danen / Red Hat Security Response Team 

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.