Published: 21/11/2012 Updated: 05/04/2013

CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9

VMScore: 641

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

Munin prior to 2.0.6 stores plugin state files that run as root in the same group-writable directory as non-root plugins, which allows local users to execute arbitrary code by replacing a state file, as demonstrated using the smart_ plugin.

Vulnerable Product	Search on Vulmon	Subscribe to Product
munin-monitoring munin 2.0.4
munin-monitoring munin 2.0.3
munin-monitoring munin 2.0-rc4
munin-monitoring munin 2.0-rc3
munin-monitoring munin 2.0-beta1
munin-monitoring munin 2.0-rc2
munin-monitoring munin
munin-monitoring munin 2.0-rc6
munin-monitoring munin 2.0-rc5
munin-monitoring munin 2.0-beta3
munin-monitoring munin 2.0-beta2
munin-monitoring munin 2.0.0
munin-monitoring munin 2.0-rc7
munin-monitoring munin 2.0-beta5
munin-monitoring munin 2.0-beta4
munin-monitoring munin 2.0.2
munin-monitoring munin 2.0.1
munin-monitoring munin 2.0-rc1
munin-monitoring munin 2.0-beta7
munin-monitoring munin 2.0-beta6

Several security issues were fixed in Munin ...

Debian Bug report logs - #684075 munin: CVE-2012-3512: insecure state file handling, munin->root Package: munin-plugins-core; Maintainer for munin-plugins-core is Munin Debian Maintainers <team+munin@trackerdebianorg>; Source for munin-plugins-core is src:munin (PTS, buildd, popcon) Reported by: Stevie Trujillo <stev ...

Debian Bug report logs - #684076 munin-cgi-graph: User can load new config, pointing log to arbitrary file Package: munin; Maintainer for munin is Munin Debian Maintainers <team+munin@trackerdebianorg>; Source for munin is src:munin (PTS, buildd, popcon) Reported by: Stevie Trujillo <stevietrujillo@gmailcom> Date ...

Munin before 206 stores plugin state files that run as root in the same group-writable directory as non-root plugins, which allows local users to execute arbitrary code by replacing a state file, as demonstrated using the smart_ plugin ...

CWE-264 http://www.openwall.com/lists/oss-security/2012/08/21/1 http://www.ubuntu.com/usn/USN-1622-1 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=684075 http://www.munin-monitoring.org/ticket/1234 http://www.securityfocus.com/bid/55698 http://lists.fedoraproject.org/pipermail/package-announce/2012-September/086375.html http://lists.fedoraproject.org/pipermail/package-announce/2012-September/088260.html http://lists.fedoraproject.org/pipermail/package-announce/2012-September/088239.html https://usn.ubuntu.com/1622-1/https://nvd.nist.gov

CVE-2012-3512

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect