The Trigger plugin in bcfg2 1.2.x before 1.2.3 allows remote attackers with root access to the client to execute arbitrary commands via shell metacharacters in the UUID field to the server process (bcfg2-server).

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The Trigger plugin in bcfg2 1.2.x before 1.2.3 allows remote attackers with root access to the client to
    execute arbitrary commands via shell metacharacters in the UUID field to the server process
    (bcfg2-server). (CVE-2012-3366)

It was discovered that malicious clients can trick the server component of the Bcfg2 configuration management system to execute commands with root privileges.

ID	Name	Product	Family	Severity
401285	Alpine: bcfg2: security update to 1.2.2-r1 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
401285	Alpine: bcfg2: security update to 1.2.2-r1 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
401283	Alpine: bcfg2: security update to 1.2.2-r1 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
401283	Alpine: bcfg2: security update to 1.2.2-r1 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
59781	Debian DSA-2503-1 : bcfg2 - shell command injection	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2012-3366

high

Tenable Plugins

high

high

high

high

high