CVE - CVE-2012-3537

CVE-ID
CVE-2012-3537	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The Crowbar Ohai plugin (chef/cookbooks/ohai/files/default/plugins/crowbar.rb) in the Deployer Barclamp in Crowbar, possibly 1.4 and earlier, allows local users to execute arbitrary shell commands via vectors related to "insecure handling of tmp files" and predictable file names.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:55240 URL:http://www.securityfocus.com/bid/55240 CONFIRM:https://github.com/dellcloudedge/barclamp-deployer/pull/57 MISC:https://bugzilla.novell.com/show_bug.cgi?id=774967 MISC:https://github.com/SUSE-Cloud/barclamp-deployer/commit/5ea8d4ddaa4cb1ce834d36889f0fe7ac0d617bc8 MISC:https://github.com/SUSE-Cloud/barclamp-deployer/commit/b6454268a067fc77ff5de82057b5b53b3cc38b87 MLIST:[oss-security] 20120827 CVE request: crowbar ohai plugin: local privilege (root) escalation due to insecure tmp file handling URL:http://www.openwall.com/lists/oss-security/2012/08/27/5 MLIST:[oss-security] 20120827 Re: CVE request: crowbar ohai plugin: local privilege (root) escalation due to insecure tmp file handling URL:http://www.openwall.com/lists/oss-security/2012/08/27/7 OSVDB:84955 URL:~~http://osvdb.org/84955~~ (Obsolete source) SECUNIA:50442 URL:http://secunia.com/advisories/50442 XF:crowbar-privilege-escalation(78041) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/78041
Assigning CNA
Red Hat, Inc.
Date Record Created
20120614	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20120614)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)