A code injection flaw was found in the way Cobbler processed templates for kickstart files. A remote authenticated user, that has the Configuration Administrator role privilege, could use this flaw to create a specially-crafted kickstart template file containing embedded Python code, that could, when processed by the Cheetah template processing engine, execute arbitrary code with the privileges of the privileged system user (root) on the Red Hat Network Satellite Server host.

References: [1] https://fedorahosted.org/cobbler/wiki/KickstartTemplating

Acknowledgements:

Red Hat would like to thank Doug Knight of University of Alaska for reporting this issue.

Cobbler before 1.6.1 does not properly determine whether an installation has the default password, which makes it easier for attackers to obtain access by using this password.