Mutiny Technology virtual appliance command injection vulnerability

Overview

The Mutiny Technology virtual appliance contains a command injection vulnerability which could allow an attacker to inject commands into the appliance.

Description

CWE-77: Improper Neutralization of Special Elements used in a Command (‘Command Injection’)

The Mutiny Technology virtual appliance contains a network interface menu which is vulnerable to command injection with root privileges.

---

Impact

An authenticated attacker can run arbitrary commands on the appliance.

---

Solution

Update

The vendor has stated that this vulnerability has been addressed in Mutiny Technology virtual appliance version 4.5-1.12. Users are advised to upgrade to Mutiny Technology virtual appliance version 4.5-1.12 or higher.

---

Restrict access

As a general good security practice, only allow connections from trusted hosts and networks. Restricting access would prevent an attacker from accessing a Mutiny Technology virtual appliance using stolen credentials from a blocked network location.

---

Vendor Information

841851

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Mutiny Technologies Affected

Notified: August 09, 2012 Updated: October 09, 2012

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

CVSS Metrics

Group	Score	Vector
Base	2.1	AV:N/AC:H/Au:S/C:N/I:P/A:N
Temporal	1.4	E:U/RL:OF/RC:UC
Environmental	0.6	CDP:L/TD:L/CR:ND/IR:ND/AR:ND

References

• <http://cwe.mitre.org/data/definitions/77.html&gt;
• <http://www.mutiny.com/releasehistory.php&gt;

Acknowledgements

Thanks to Christopher Campbell for reporting this vulnerability.

This document was written by Michael Orlando.

Other Information

CVE IDs:	CVE-2012-3001
Date Public:	2012-10-07 Date First Published: