CVE-2016-3728 : Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Prox

Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x before 1.11.2 allows remote attackers to execute arbitrary code via the PXE template type portion of the PATH_INFO to tftp/.

Published 2016-05-20 14:59:04

Updated 2023-02-12 23:20:09

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Execute codeBypassGain privilege

Products affected by CVE-2016-3728

Theforeman » Foreman » Version: 1.11.0
cpe:2.3:a:theforeman:foreman:1.11.0:*:*:*:*:*:*:*
Matching versions
Theforeman » Foreman » Version: 1.10.3
cpe:2.3:a:theforeman:foreman:1.10.3:*:*:*:*:*:*:*
Matching versions
Theforeman » Foreman » Version: 1.11.1
cpe:2.3:a:theforeman:foreman:1.11.1:*:*:*:*:*:*:*
Matching versions
Theforeman » Foreman » Version: 1.11.0 Update RC1
cpe:2.3:a:theforeman:foreman:1.11.0:rc1:*:*:*:*:*:*
Matching versions
Theforeman » Foreman » Version: 1.11.0 Update RC3
cpe:2.3:a:theforeman:foreman:1.11.0:rc3:*:*:*:*:*:*
Matching versions
Theforeman » Foreman » Version: 1.11.0 Update RC2
cpe:2.3:a:theforeman:foreman:1.11.0:rc2:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2016-3728

EPSS FAQ

3.54%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 92 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-3728

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P	8.6	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
8.8	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2016-3728

CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-3728

https://access.redhat.com/errata/RHBA-2016:1501

RHBA-2016:1501 - Bug Fix Advisory - Red Hat Customer Portal

CVEs referencing this url
https://github.com/theforeman/smart-proxy/commit/eef532aa668d656b9d61d9c6edf7c2505f3f43c7

Fixes #14931 - TFTP class instantiating fixed · theforeman/smart-proxy@eef532a · GitHub
http://theforeman.org/security.html#2016-3728

Foreman :: Security
Vendor Advisory
http://projects.theforeman.org/issues/14931

Bug #14931: CVE-2016-3728 - Arbitrary code execution via TFTP file variant parameter - Smart Proxy - Foreman
http://www.openwall.com/lists/oss-security/2016/05/19/2

oss-security - CVE-2016-3728: remote code execution in Foreman smart proxy TFTP API

Jump to

Vulnerability Details : CVE-2016-3728

Products affected by CVE-2016-3728

Exploit prediction scoring system (EPSS) score for CVE-2016-3728

CVSS scores for CVE-2016-3728

CWE ids for CVE-2016-3728

References for CVE-2016-3728