NVD

Id
45128  
Name
CVE-2012-3537  
Description
The Crowbar Ohai plugin (chef/cookbooks/ohai/files/default/plugins/crowbar.rb) in the Deployer Barclamp in Crowbar, possibly 1.4 and earlier, allows local users to execute arbitrary shell commands via vectors related to "insecure handling of tmp files" and predictable file names.  
Reject
 
CVSS Version
2  
CVSS Score
4.6  
Severity
Medium  
CVSS Base Score
4.6  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2012-09-05  
Modified Date
2012-09-06  
Seq
2012-3537  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
226473 45128 CVE-2012-3537 [oss-security] 20120827 CVE request: crowbar ohai plugin: local privilege (root) escalation due to insecure tmp file handling  View
226474 45128 CVE-2012-3537 [oss-security] 20120827 Re: CVE request: crowbar ohai plugin: local privilege (root) escalation due to insecure tmp file handling  View
226475 45128 CVE-2012-3537 55240  View
226476 45128 CVE-2012-3537 crowbar-privilege-escalation(78041)  View
226477 45128 CVE-2012-3537 https://bugzilla.novell.com/show_bug.cgi?id=774967  View
226478 45128 CVE-2012-3537 https://github.com/dellcloudedge/barclamp-deployer/pull/57  View
226479 45128 CVE-2012-3537 https://github.com/SUSE-Cloud/barclamp-deployer/commit/5ea8d4ddaa4cb1ce834d36889f0fe7ac0d617bc8  View
226480 45128 CVE-2012-3537 https://github.com/SUSE-Cloud/barclamp-deployer/commit/b6454268a067fc77ff5de82057b5b53b3cc38b87  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
28390 JVNDB-2012-004097 Crowbar の Deployer Barclamp における任意のシェルコマンドを実行される脆弱性 Crowbar の Deployer Barclamp 内の Crowbar Ohai プラグイン (chef/cookbooks/ohai/files/default/plugins/crowbar.rb) には、"一時ファイルの不安定な取り扱い (insecure handling of tmp files)" 、および予測可能なファイル名に関する処理に不備があるため、任意のシェルコマンドを実行される脆弱性が存在します。 CVE-2012-3537 56775 CVE-2012-3537 45128 4.6 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-004097.html 2012-09-05 2012-09-07 View