It was found that bcfg2 configuration management server did not properly escape shell commands data, provided by remote bcfg2 client, prior their execution, when the SSHbase plug-in was enabled. A remote attacker, able to control the client bcfg2 machine, could use this flaw to escalate their privileges (execute arbitrary code with the privileges of the user running the bcfg2 server).

References: [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=640028 [2] http://www.openwall.com/lists/oss-security/2011/09/01/1 (CVE request) [3] http://www.openwall.com/lists/oss-security/2011/09/06/1 (CVE assignment)

Upstream patches: [4] https://github.com/solj/bcfg2/commit/f4a35efec1b6a1e54d61cf1b8bfc83dd1d89eef7 [5] https://github.com/solj/bcfg2/commit/46795ae451ca6ede55a0edeb726978aef4684b53