CVE-2011-3180
HighSummary
A vulnerability in kiwi before version 4.98.08, used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters in the path of an overlay file, related to chown.
Risk Assessment
Attackers can exploit this vulnerability to gain unauthorized access to the system, potentially leading to serious security breaches.
Recommendation
It is recommended to update kiwi to version 4.98.08 or later and to update SUSE Studio Onsite and SUSE Studio Extension to version 1.2.1 or later.
Other vulnerabilities in kiwi, SUSE Studio Onsite, SUSE Studio Extension for System z
See all- CVE-2011-4195High
A vulnerability in kiwi before version 4.98.05, used in SUSE Studio Onsite 1.2 before version 1.2.1 and SUSE Studio Extension for System z 1.2 before version 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters in an image name.
- CVE-2011-4192High
Kiwi before version 4.85.1, used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands as demonstrated by 'double quotes in kiwi_oemtitle of .profile.'
Original NVD description (English source)
kiwi before 4.98.08, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters in the path of an overlay file, related to chown.