Vulnerabilities > CVE-2012-3448 - PHP Code Execution vulnerability in Ganglia

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
ganglia
nessus
exploit available
NVD
Published: 2012-08-06
Updated: 2018-08-04

Summary

Unspecified vulnerability in Ganglia Web before 3.5.1 allows remote attackers to execute arbitrary PHP code via unknown attack vectors.

Vulnerable Configurations

Part Description Count
Application
Ganglia
14

Exploit-Db

descriptionGanglia Web Frontend < 3.5.1 - PHP Code Execution. CVE-2012-3448. Webapps exploit for php platform
fileexploits/php/webapps/38030.php
idEDB-ID:38030
last seen2016-02-04
modified2015-08-31
platformphp
port
published2015-08-31
reporterAndrei Costin
sourcehttps://www.exploit-db.com/download/38030/
titleGanglia Web Frontend < 3.5.1 - PHP Code Execution
typewebapps

Nessus

  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-2610.NASL
    descriptionInsufficient input sanitization in Ganglia, a web-based monitoring system, could lead to remote PHP script execution with permissions of the user running the web server.
    last seen2020-03-17
    modified2013-01-22
    plugin id63640
    published2013-01-22
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/63640
    titleDebian DSA-2610-1 : ganglia - arbitrary script execution
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201412-10.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201412-10 (Multiple packages, Multiple vulnerabilities fixed in 2012) Vulnerabilities have been discovered in the packages listed below. Please review the CVE identifiers in the Reference section for details. EGroupware VTE Layer Four Traceroute (LFT) Suhosin Slock Ganglia Jabber to GaduGadu Gateway Impact : A context-dependent attacker may be able to gain escalated privileges, execute arbitrary code, cause Denial of Service, obtain sensitive information, or otherwise bypass security restrictions. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id79963
    published2014-12-15
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/79963
    titleGLSA-201412-10 : Multiple packages, Multiple vulnerabilities fixed in 2012
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2012-10699.NASL
    descriptionFix for arbitrary PHP file execution Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2012-07-26
    plugin id60122
    published2012-07-26
    reporterThis script is Copyright (C) 2012-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/60122
    titleFedora 17 : ganglia-3.1.7-6.fc17 (2012-10699)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2012-10727.NASL
    descriptionFix for arbitrary PHP file execution Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2012-07-26
    plugin id60123
    published2012-07-26
    reporterThis script is Copyright (C) 2012-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/60123
    titleFedora 16 : ganglia-3.1.7-5.fc16 (2012-10727)

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/133379/ganglia-exec.txt
idPACKETSTORM:133379
last seen2016-12-05
published2015-08-31
reporterAndrei Costin
sourcehttps://packetstormsecurity.com/files/133379/Ganglia-Web-Frontend-PHP-Code-Execution.html
titleGanglia Web Frontend PHP Code Execution

Seebug

bulletinFamilyexploit
description<p>1. Assuming that ganglia is installed on the target machine at this path:</p><p>/var/www/html/ganglia/</p><p>&nbsp;</p><p>2. Assuming the attacker has minimal access to the target machine and&nbsp;</p><p>can write to "/tmp". There are several methods where a remote attacker can&nbsp;</p><p>also trigger daemons or other system processes to create files in "/tmp"&nbsp;</p><p>whose content is (partially) controlled by the remote attacker.&nbsp;</p><p>&nbsp;</p><p>3. The attacker puts the contents of this PoC file into the file:</p><p>/tmp/attack.php</p><p>&nbsp;</p><p>4. The attacker visits the Ganglia Web Frontend interface with version &lt; 3.5.1&nbsp;</p><p>as:</p><p><a href="http://targetIP/ganglia/graph.php?g=../../../../tmp/attack&amp;metric=DUMMY&amp;title=DUMMY" rel="nofollow">http://targetIP/ganglia/graph.php?g=../../../../tmp/attack&amp;metric=DUMMY&amp;title=DUMMY</a></p><p>&nbsp;</p><p>5. Confirm that the PoC created a dummy file in the /tmp folder and copied&nbsp;</p><p>/etc/passwd to /tmp.</p>
idSSV:89282
last seen2017-11-19
modified2015-09-01
published2015-09-01
reporter00r00
sourcehttps://www.seebug.org/vuldb/ssvid-89282
titleGanglia Web Frontend < 3.5.1 - PHP Code Execution

References