CVE-2012-3512

Publication date 21 August 2012

Last updated 24 July 2024

Ubuntu priority

Munin before 2.0.6 stores plugin state files that run as root in the same group-writable directory as non-root plugins, which allows local users to execute arbitrary code by replacing a state file, as demonstrated using the smart_ plugin.

Read the notes from the security team

Status

Show unmaintained releases

No maintained releases are affected by this CVE.

Package	Ubuntu Release	Status
munin	12.10 quantal	Fixed 2.0.2-1ubuntu2.2
	12.04 LTS precise	Fixed 1.4.6-3ubuntu3.3
	11.10 oneiric	Fixed 1.4.5-3ubuntu4.11.10.2
	11.04 natty	Ignored end of life
	10.04 LTS lucid	Fixed 1.4.4-1ubuntu1.2
	8.04 LTS hardy	Ignored end of life

Notes

sbeattie

munin user/group to root escalation

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
munin	Upstream: http://anonscm.debian.org/gitweb/?p=collab-maint/munin.git;a=commit;h=780634c4a48fc57b6631d644fca3649f1417d211 Upstream: http://anonscm.debian.org/gitweb/?p=collab-maint/munin.git;a=commit;h=9f2643c4cb13a34deadfea8fb7e8a29fa54fdc8e Upstream: http://anonscm.debian.org/gitweb/?p=collab-maint/munin.git;a=commit;h=6183662a2b96c2c3b1b4cfc4b80ce28063d025c2 Upstream: http://anonscm.debian.org/gitweb/?p=collab-maint/munin.git;a=commit;h=2b8d82e0c52ccdd79ca480788f7ef4d3325b4cb0

Package

Patch details

munin

References

Related Ubuntu Security Notices (USN)

USN-1622-1
Munin vulnerabilities
5 November 2012

Other references

https://www.cve.org/CVERecord?id=CVE-2012-3512