Incomplete blacklist vulnerability in action_power.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the power_system method in the xmlrpc API.

This update for cobbler fixes the following issues :

  - Add cobbler-tests subpackage for unit testing for     openSUSE/SLE 

  - Adds LoadModule definitions for openSUSE/SLE

  - Switch to new refactored auth module.

  - use systemctl to restart cobblerd on logfile rotation     (boo#1169207) Mainline logrotate conf file uses already     /sbin/service instead of outdated: /etc/init.d/cobblerd

  - Fix cobbler sync for DHCP or DNS (boo#1169553) Fixed     mainline by commit 2d6cfe42da

  - Signatures file now uses 'default_autoinstall' which     fixes import problem happening with some distributions     (boo#1159010)

  - Fix for kernel and initrd detection (boo#1159010)

  - New :

  - For the distro there is now a parameter     remote_boot_initrd and remote_boot_kernel ()

  - For the profile there is now a parameter filename for     DHCP. (#2280)

  - Signatures for ESXi 6 and 7 (#2308)

  - The hardlink command is now detected more dynamically     and thus more error resistant (#2297)

  - HTTPBoot will now work in some cases out of the bug.
    (#2295)

  - Additional DNS query for a case where the wrong record     was queried in the nsupdate system case (#2285)

  - Changes :

  - Enabled a lot of tests, removed some and implemented     new. (#2202)

  - Removed not used files from the codebase. (#2302)

  - Exchanged mkisofs to xorrisofs. (#2296)

  - Removed duplicate code. (#2224)

  - Removed unreachable code. (#2223)

  - Snippet creation and deletion now works again via     xmlrpc. (#2244)

  - Replace createrepo with createrepo_c. (#2266)

  - Enable Kerberos through having a case sensitive     users.conf. (#2272)

  - Bugfixes :

  - General various Bugfixes (#2331, )

  - Makefile usage and commands. (#2344, #2304)

  - Fix the dhcp template. (#2314)

  - Creation of the management classes and gPXE. (#2310)

  - Fix the scm_track module. (#2275, #2279)

  - Fix passing the netdevice parameter correctly to the     linuxrc. (#2263)

  - powerstatus from cobbler now works thanks to a wrapper     for ipmitool. (#2267)

  - In case the LDAP is used for auth, it now works with     ADs. (#2274)

  - Fix passthru authentication. (#2271)

  - Other :

  - Add Codecov. (#2229)

  - Documentation updates. (#2333, #2326, #2305, #2249,     #2268)

  - Buildprocess :

  - Recreation and cleanup of Grub2. (#2278)

  - Fix small errors for openSUSE Leap. (#2233)

  - Fix rpmlint errors. (#2237)

  - Maximum compatibility for debbuild package creation.
    (#2255, #2292, #2242, #2300)

  - Fixes related to our CI Pipeline (#2254, #2269)

  - Internal Code cleanup (#2273, #2270)

  - Breaking Changes :

  - Hash handling in users.digest file. (#2299) 

  - Updated to version 3.1.1.

  - Introduce new packaging from upstream

  - Changelog see below

  - New :

  - We are now having a cross-distro specfile which can be     build in the OBS (#2220) - before rewritten it was     improved by #2144 & #2174

  - Grub Submenu for net-booting machines (#2217)

  - Building the Cent-OS RPMs in Docker (#2190 #2189)

  - Reintroduced manpage build in setup.py (#2185)

  - mgmt_parameters are now passed to the dhcp template     (#2182)

  - Using the standard Pyhton3 logger instead of a custom     one (#2160 #2139 #2151)

  - Script for converting the settings file from 3.0.0 to     3.0.1 (#2154)

  - Docs now inside the repo instead of cobbler.github.io     and improved with sphinx (#2117)

  - Changes :

  - The default tftpboot directory is now /var/lib/tftpboot     instead of previously /srv/tftpboot (#2220)

  - Distro signatures were adjusted where necessary (#2219     #2134)

  - Removed requirements.txt and placed the requirements in     setup.py (#2204)

  - Display only entries in grub which are from the same     arch (#2191 #2216)

  - Change the name of the cobbler manpage form cobbler-cli     to cobbler back and move it to section 8 (#2188 #2186)

  - Bugfixes :

  - Incremented Version to 3.1.1 from 3.0.1

  - S390 Support was cleaned up (#2207 #2178)

  - PowerPC Support was cleaned up (#2178)

  - Added a missing import while importing a distro with     cobbler import (#2201)

  - Fixed a case where a stacktrace would be produced so     pass none instead (#2203)

  - Rename of suse_kopts_textmode_overwrite to     kops_overwrite to utils (#2143 #2200)

  - Fix rsync subprocess call (#2199 #2179)

  - Fixed an error where the template rendering did not work     (#2176)

  - Fixed some cobbler import errors (#2172)

  - Wrong shebang in various scripts (#2148)

  - Fix some imports which fixes errors introduced by the     remodularization (#2150 #2153)

  - Other :

  - Issue Templates for Github (#2187)

  - Update to latest git HEAD code base This version (from     mainline so for quite a while already) also includes     fixes for 'boo#1149075' and boo#1151875

  - Fix for cobbler import and buildiso (boo#1156574)

  - Adjusted manpage creation (needs sphinx as     BuildRequires)

  - Fix cobbler sync for dhcp and dns enabled due to latest     module renaming patches

  - Update to latest git HEAD

  - Fixes permission denied in apache2 context when trying     to write cobbler log

  - Fixes a bad import in import_signature (item)

  - Fixes bad shebang bash path in mkgrub.sh (used in post     section)

  - Now track Github master branch WARNING: This release     contains breaking changes for your settings file! 

  - Notable changes :

  - Now using standard python logger

  - Updated dhcpd.template 

  - Removed fix_shebang.patch: now in upstream. 

  - added -s parameter to fdupes call to prevent hardlink     across partititons

  - Update to latest v3.0.0 cobbler release

  - Add previouly added patch:
    exclude_get-loaders_command.patch to the list of patches     to apply.

  - Fix log file world readable (as suggested by Matthias     Gerstner) and change file attributes via attr in spec     file

  - Do not allow get-loaders command (download of     third-party provided network boot loaders we do not     trust)

  - Mainline fixes: 3172d1df9b9cc8 Add missing help text in     redhat_management_key field c8f5490e507a72 Set default     interface if cobbler system add has no

    --interface= param 31a1aa31d26c4a Remove apache     IfVersion tags from apache configs

  - Integrated fixes that came in from mainline from other     products (to calm down obs regression checker):
    CVE-2011-4953, fate#312397, boo#660126, boo#671212,     boo#672471, boo#682665 boo#687891, boo#695955,     boo#722443, boo#722445, boo#757062, boo#763610     boo#783671, boo#790545, boo#796773, boo#811025,     boo#812948, boo#842699 boo#846580, boo#869371,     boo#884051, boo#976826, boo#984998 Some older bugs need     boo# references as well: boo#660126, boo#671212,     boo#672471, boo#682665 boo#687891, boo#695955,     boo#722443, boo#722445, boo#757062, boo#763610     boo#783671, boo#790545, boo#796773, boo#811025,     boo#812948, boo#842699 boo#846580, boo#869371,     boo#884051

  - Fix for redhat_management_key not being listed as a     choice during profile rename (boo#1134588)

  - Added :

  - rhn-mngmnt-key-field-fix.diff

  - Fixes distribution detection in setup.py for SLESo

  - Added :

  -     changes-detection-to-distro-like-for-suse-distributions.
    diff

  - Moving to pytest and adding Docker test integration

  - Added :

  - add-docker-integration-testing.diff

  - refactor-unittest-to-pytest.diff

  - Additional compatability changes for old Koan versions.

  - Modified :

  - renamed-methods-alias-part2.patch

  - Old Koan versions not only need method aliases, but also     need compatible responses

  - Added :

  - renamed-methods-alias-part2.patch

  - Add the redhat_managment_* fields again to enable     templating in SUMA.

  - Added :

  - revert-redhat-management-removal.patch 

  - Changes return of last_modified_time RPC to float

  - Added :

  - changes-return-to-float.diff

  - provide old name aliases for all renamed methods :

  - get_distro_for_koan => get_distro_as_rendered

  - get_profile_for_koan => get_profile_as_rendered

  - get_system_for_koan => get_system_as_rendered

  - get_repo_for_koan => get_repo_as_rendered

  - get_image_for_koan => get_image_as_rendered

  - get_mgmtclass_for_koan => get_mgmtclass_as_rendered

  - get_package_for_koan => get_package_as_rendered

  - get_file_for_koan => get_file_as_rendered

  - Renamed: get_system_for_koan.patch =>     renamed-methods-alias.patch

  - provide renamed method 'get_system_for_koan' under old     name for old clients.

  - Added :

  - get_system_for_koan.patch

  - Bring back power_system method in the XML-RPC API

  - Changed lanplus option to lanplus=true in     fence_ipmitool.template

  - Added :

  - power_system_xmlrpc_api.patch

  - Changed :

  - fence_ipmitool.template

  - Disables nsupdate_enabled by default

  - Added :

  - disable_nsupdate_enabled_by_default.diff

  - Fixes issue in distribution detection with 'lower'     function call.

  - Modified :

  - remodeled-distro-detection.diff 

  - Adds imporoved distribution detection. Since now all     base products get detected correctly, we no longer need     the SUSE Manager patch.

  - Added :

  - remodeled-distro-detection.diff 

  - fix grub directory layout

  - Added :

  - create-system-directory-at-the-correct-place.patch

  - fix HTTP status code of XMLRPC service

  - Added :

  - fix-http-status-code.patch

  - touch /etc/genders when it not exists (boo#1128926)

  - Add patches to fix logging

  - Added :

  - return-the-name-of-the-unknown-method.patch

  - call-with-logger-where-possible.patch

  - Switching version schema from 3.0 to 3.0.0

  - Fixes case where distribution detection returns None     (boo#1130658)

  - Added :

  - fixes-distro-none-case.diff

  - Removes newline from token, which caused authentication     error (boo#1128754)

  - Added :

  - remove-newline-from-token.diff

  - Added a patch which fixes an exception when login in     with a non-root user.

  - Added :

  - fix-login-error.patch

  - Added a patch which fixes an exception when login in     with a non-root user.

  - Added :

  - fix-login-error.patch



  - Remove patch merged at upstream :

  - 0001-return-token-as-string.patch

  - change grub2-x86_64-efi dependency to Recommends

  - grub2-i386pc is not really required. Changed to     recommended to allow building for architectures other     than x86_64

  - Use cdrtools starting with SLE-15 and Leap-15 again.
    (boo#1081739)

  - Update cobbler loaders server hostname (boo#980577)

  - Update outdated apache config (boo#956264)

  - Replace builddate with changelog date to fix     build-compare (boo#969538)

  - LOCKFILE usage removed on openSUSE (boo#714618)

  - Power management subsystem completely re-worked to     prevent command-injection (CVE-2012-2395)

  - Removed patch merged at upstream :

  - cobblerd_needs_apache2_service_started.patch

  - Checking bug fixes of released products are in latest     develop pkg :

  - remove fix-nameserver-search.fix; bug is invalid     (boo#1029276)

    -> not needed anymore

  - fix cobbler yaboot handling (boo#968406, boo#966622)

    -> no yaboot support anymore

  - support UEFI boot with cobbler generated tftp tree     (boo#1020376)

    -> upstream

  - Enabling PXE grub2 support for PowerPC (boo#986978)

    -> We have grub2 support for ppc64le

  - (boo#1048183) fix missing args and location for xen

    -> is in

  - no koan support anymore: boo#969541, boo#924118,     boo#967523

  - not installed (boo#966841) works.

  - These still have to be looked at: SUSE system as systemd     only (boo#952844) handle list value for kernel options     correctly (boo#973413) entry in pxe menu (boo#988889)

  - This still has to be switched off (at least in internal     cobbler versions): Disabling 'get-loaders' command and     'check' fixed. boo#973418

  - Add explicity require to tftp, so it is used for both     SLE and openSUSE (originally from jgonzalez@suse.com)

  - Moved Recommends according to spec_cleaner

  - Require latest apache2-mod_wsgi-python3 package This     fixes interface to http://localhost/cblr/svc/...

  - Use latest github cobbler/cobbler master branch in
    _service file

  - cobblerd_needs_apache2_service_started.patch reverted,     that is mainline now :

  - Only recommend grub2-arm and grub2-ppc packages or we     might not be able to build on factory where arm/ppc     might not be built

  - Remove genders package requires. A genders file is     generated, but we do not need/use the genders package.

  - Update to latest cobbler version 3.0 mainline git HEAD     version and remove already integrated or not needed     anymore patches.

  - Serial console support added, did some testing already     Things should start to work as expected

  - Add general grub2 support

  - Put mkgrub.* into mkgrub.sh

  - Add git date and commit to version string for now

  - Add grub2 mkimage scripts: mkgrub.i386-pc     mkgrub.powerpc-ieee1275 mkgrub.x86_64-efi     mkgrub.arm64-efi and generate grub executables with them     in the %post section



  - build server wants explicite package in BuildRequires;
    use tftp

  - require tftp(server) instead of atftp

  - cleanup: cobbler is noarch, so arch specific requires do     not make sense

  - SLES15 is using /etc/os-release instead of     /etc/SuSE-release, use this one for checking also

  - add sles15 distro profile (boo#1090205)

  - fix signature for SLES15 (boo#1075014)

  - fix signature for SLES15 (boo#1075014)

  - fix koan wait parameter initialization

  - Fix koan shebang

  - Escape shell parameters provided by the user for the     reposync action (CVE-2017-1000469) (boo#1074594)

  - detect if there is already another instance of 'cobbler     sync' running and exit with failure if so (boo#1081714)

  - do not try to hardlink to a symlink. The result will be     a dangling symlink in the general case (boo#1097733)

  - fix service restart after logrotate for cobblerd     (boo#1113747)

  - rotate cobbler logs at higher frequency to prevent disk     fillup (boo#1113747)

  - Forbid exposure of private methods in the API     (CVE-2018-10931) (CVE-2018-1000225) (boo#1104287)     (boo#1104189) (boo#1105442)

  - Check access token when calling 'modify_setting' API     endpoint (boo#1104190) (boo#1105440) (CVE-2018-1000226)

The xmlrpc interface of cobbler was prone to command injectoin

The remote Redhat Enterprise Linux 5 / 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2012:1060 advisory.

    Cobbler is a network install server. Cobbler supports PXE, virtualized     installs, and re-installing existing Linux machines.

    A command injection flaw was found in Cobbler's power management XML-RPC     method. A remote, authenticated user who is permitted to perform Cobbler     configuration changes via the Cobbler XML-RPC API, could use this flaw to     execute arbitrary code with root privileges on the Red Hat Network     Satellite server. (CVE-2012-2395)

    Note: Red Hat Network Satellite uses a special user account to configure     Cobbler. By default, only this account is permitted to perform Cobbler     configuration changes, and the credentials for the account are only     accessible to the Satellite host's administrator. As such, this issue only     affected environments where the administrator allowed other users to make     Cobbler configuration changes.

    Users of Red Hat Network Satellite 5.4 are advised to upgrade to this     updated cobbler package, which contains a backported patch to correct this     issue. Red Hat Network Satellite must be restarted     (/usr/sbin/rhn-satellite restart) for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Cobbler install on the remote host is affected by a command injection vulnerability that can be exploited by sending a specially crafted username or password argument to the 'power_system' method. 

Successful exploitation requires an authenticated user and xmlrpc API access.

ID	Name	Product	Family	Severity
145357	openSUSE Security Update : cobbler (openSUSE-2021-46)	Nessus	SuSE Local Security Checks	critical
74635	openSUSE Security Update : cobbler (openSUSE-SU-2012:0655-1)	Nessus	SuSE Local Security Checks	high
64047	RHEL 5 / 6 : cobbler (RHSA-2012:1060)	Nessus	Red Hat Local Security Checks	critical
59402	Cobbler xmlrpc API power_system Method Remote Shell Command Execution	Nessus	CGI abuses	high

Detections

Analytics

CVE-2012-2395

critical

Tenable Plugins

critical

high

critical

high