CVE-2011-4192
HighSummary
Kiwi before version 4.85.1, used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands as demonstrated by 'double quotes in kiwi_oemtitle of .profile.'
Risk Assessment
Exploitation of this vulnerability may lead to unauthorized access to the system and execution of malicious code, posing a serious security threat to the organization.
Recommendation
It is recommended to update kiwi to version 4.85.1 or later and SUSE Studio Onsite and SUSE Studio Extension to version 1.2.1 or later to mitigate the risks associated with this vulnerability.
Other vulnerabilities in kiwi, SUSE Studio Onsite, SUSE Studio Extension for System z
See all- CVE-2011-4195High
A vulnerability in kiwi before version 4.98.05, used in SUSE Studio Onsite 1.2 before version 1.2.1 and SUSE Studio Extension for System z 1.2 before version 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters in an image name.
- CVE-2011-3180High
A vulnerability in kiwi before version 4.98.08, used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters in the path of an overlay file, related to chown.
Original NVD description (English source)
kiwi before 4.85.1, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands as demonstrated by "double quotes in kiwi_oemtitle of .profile."