CVE-2016-9605

Vulnerability

The vulnerability resides in the Cobbler software component, specifically in the cobbler-web interface, version 2.6.11-1. The flaw is an invalid parameter validation vulnerability that leads to arbitrary file reading. This occurs via a crafted URL that includes a script parameter with directory traversal sequences (e.g., ../../../../../etc/passwd).

Exploitation

An attacker can exploit this vulnerability by navigating to a specially crafted URL on a default installation of Cobbler and cobbler-web. The URL pattern is: http://localhost/cblr/svc/profile/<valid_profile>/op/script?scriptx=script/script/script/script/script/script/script/script/&script=../../../../../etc/passwd. No authentication is mentioned as required; the attacker only needs network access to the Cobbler web interface [2].

Impact

Successful exploitation allows the attacker to read arbitrary files on the system, such as /etc/passwd, leading to information disclosure. The impact is limited to reading files, not writing or code execution, but sensitive data can be exposed [1][2].

Mitigation

As of the available references, no fix has been released for this specific version (2.6.11-1). Red Hat Satellite 5, which includes Cobbler, is in a support phase where this issue is not planned to be addressed [2]. Users are advised to restrict network access to the cobbler-web interface and monitor for any future updates from the project repository [3]. No workaround is explicitly provided.