Project

General

Profile

Actions

Bug #14931

closed

CVE-2016-3728 - Arbitrary code execution via TFTP file variant parameter

Added by Dominic Cleal almost 8 years ago. Updated over 5 years ago.

Status:
Closed
Priority:
High
Category:
Security
Target version:
Difficulty:
Triaged:
Fixed in Releases:
Found in Releases:

Description

An arbitrary code execution vulnerability has been reported in the TFTP module, where the variant part of the URL (/tftp/<variant>/<MAC>) is passed into eval().

https://github.com/theforeman/smart-proxy/blob/1.11.1/modules/tftp/tftp_api.rb#L17

Mitigation: ensure trusted_hosts is set to only authorise Foreman hosts to use the API, and preferably only use HTTPS for better authentication.

Affects Smart Proxy 0.2 or higher.

Thanks to Lukas Zapletal for reporting to , a CVE will be assigned shortly.

Actions #1

Updated by The Foreman Bot almost 8 years ago

  • Status changed from Assigned to Ready For Testing
  • Pull request https://github.com/theforeman/smart-proxy/pull/415 added
Actions #2

Updated by Dominic Cleal almost 8 years ago

  • Subject changed from Arbitrary code execution via TFTP file variant parameter to CVE-2016-3728 - Arbitrary code execution via TFTP file variant parameter

CVE-2016-3728 was assigned for this vulnerability.

Actions #3

Updated by Anonymous almost 8 years ago

  • Status changed from Ready For Testing to Closed
  • % Done changed from 0 to 100
Actions #4

Updated by Dominic Cleal almost 8 years ago

  • translation missing: en.field_release set to 152
Actions

Also available in: Atom PDF