CVE-2014-3486

2014-07-0714:55:00

CWE-59

[email protected]

web.nvd.nist.gov

cve-2014-3486

arbitrary command execution

symlink attack

red hat cloudforms 3.0

nvd

7.1 High

AI Score

Confidence

Low

6.9 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

5.2%

JSON

The (1) shell_exec function in lib/util/MiqSshUtilV1.rb and (2) temp_cmd_file function in lib/util/MiqSshUtilV2.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allow local users to execute arbitrary commands via a symlink attack on a temporary file with a predictable name.

CPENameOperatorVersion
redhat:cloudforms_3.0_management_engineredhat cloudforms 3.0 management engineeq5.2.1
redhat:cloudforms_3.0_management_engineredhat cloudforms 3.0 management enginele5.2.4
redhat:cloudforms_3.0_management_engineredhat cloudforms 3.0 management engineeq5.2.1.6
redhat:cloudforms_3.0_management_engineredhat cloudforms 3.0 management engineeq5.2.3.2
redhat:cloudforms_3.0_management_engineredhat cloudforms 3.0 management engineeq5.2.2
redhat:cloudforms_3.0_management_engineredhat cloudforms 3.0 management engineeq5.2
redhat:cloudforms_3.0_management_engineredhat cloudforms 3.0 management engineeq5.2.3

CPE	Name	Operator	Version
redhat:cloudforms_3.0_management_engine	redhat cloudforms 3.0 management engine	eq	5.2.1
redhat:cloudforms_3.0_management_engine	redhat cloudforms 3.0 management engine	le	5.2.4
redhat:cloudforms_3.0_management_engine	redhat cloudforms 3.0 management engine	eq	5.2.1.6
redhat:cloudforms_3.0_management_engine	redhat cloudforms 3.0 management engine	eq	5.2.3.2
redhat:cloudforms_3.0_management_engine	redhat cloudforms 3.0 management engine	eq	5.2.2
redhat:cloudforms_3.0_management_engine	redhat cloudforms 3.0 management engine	eq	5.2
redhat:cloudforms_3.0_management_engine	redhat cloudforms 3.0 management engine	eq	5.2.3