Incomplete blacklist vulnerability in actionpower.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the powersystem method in the xmlrpc API.

Cobbler before 2.0.4 uses an incorrect umask value, which allows local users to have an unspecified impact by leveraging world writable permissions for files and directories.

Cobbler before 1.6.1 does not properly determine whether an installation has the default password, which makes it easier for attackers to obtain access by using this password.

A code injection flaw was found in the way Cobbler processed templates for kickstart files. A remote authenticated user, that has the Configuration Administrator role privilege, could use this flaw to create a specially-crafted kickstart template file containing embedded Python code, that could, when processed by the Cheetah template processing engine, execute arbitrary code with the privileges of the privileged system user (root) on the Red Hat Network Satellite Server host.

References: [1] https://fedorahosted.org/cobbler/wiki/KickstartTemplating

Acknowledgements:

Red Hat would like to thank Doug Knight of University of Alaska for reporting this issue.

The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.