CVE-2016-3728

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2016-3728
Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x before 1.11.2 allows remote attackers to execute arbitrary code via the PXE template type portion of the PATH_INFO to tftp/.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://projects.theforeman.org/issues/14931
http://theforeman.org/security.html#2016-3728 Vendor Advisory
http://www.openwall.com/lists/oss-security/2016/05/19/2
https://access.redhat.com/errata/RHBA-2016:1501
https://github.com/theforeman/smart-proxy/commit/eef532aa668d656b9d61d9c6edf7c2505f3f43c7
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:theforeman:foreman:1.11.0:*:*:*:*:*:*:*
cpe:2.3:a:theforeman:foreman:1.11.0:rc1:*:*:*:*:*:*
cpe:2.3:a:theforeman:foreman:1.11.0:rc2:*:*:*:*:*:*
cpe:2.3:a:theforeman:foreman:1.11.0:rc3:*:*:*:*:*:*
cpe:2.3:a:theforeman:foreman:1.11.1:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:theforeman:foreman:1.10.3:*:*:*:*:*:*:*
History

12 Feb 2023, 23:20

Type Values Removed Values Added
References
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1333378', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1333378', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2016-3728', 'name': 'https://access.redhat.com/security/cve/CVE-2016-3728', 'tags': [], 'refsource': 'MISC'}
Summary It was found that the “variant” parameter in the TFTP API of Foreman was passed to the eval() function. An attacker could possibly use this flaw to execute arbitrary code with the privileges of the Foreman user. Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x before 1.11.2 allows remote attackers to execute arbitrary code via the PXE template type portion of the PATH_INFO to tftp/.

02 Feb 2023, 21:16

Type Values Removed Values Added
Summary Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x before 1.11.2 allows remote attackers to execute arbitrary code via the PXE template type portion of the PATH_INFO to tftp/. It was found that the “variant” parameter in the TFTP API of Foreman was passed to the eval() function. An attacker could possibly use this flaw to execute arbitrary code with the privileges of the Foreman user.
References
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1333378 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2016-3728 -
Information

Published : 2016-05-20 14:59

Updated : 2023-12-10 11:46

NVD link : CVE-2016-3728

Mitre link : CVE-2016-3728

CVE.ORG link : CVE-2016-3728

JSON object : View

Products Affected

theforeman

  • foreman
CWE
CWE-284

Improper Access Control