CVE-2012-3512

Munin before 2.0.6 stores plugin state files that run as root in the same group-writable directory as non-root plugins, which allows local users to execute arbitrary code by replacing a state file, as demonstrated using the smart_ plugin.

Affected Software

Name	Vendor	Start Version	End Version
Munin	Munin-monitoring	*	2.0.5 (including)
Munin	Munin-monitoring	2.0-beta1 (including)	2.0-beta1 (including)
Munin	Munin-monitoring	2.0-beta2 (including)	2.0-beta2 (including)
Munin	Munin-monitoring	2.0-beta3 (including)	2.0-beta3 (including)
Munin	Munin-monitoring	2.0-beta4 (including)	2.0-beta4 (including)
Munin	Munin-monitoring	2.0-beta5 (including)	2.0-beta5 (including)
Munin	Munin-monitoring	2.0-beta6 (including)	2.0-beta6 (including)
Munin	Munin-monitoring	2.0-beta7 (including)	2.0-beta7 (including)
Munin	Munin-monitoring	2.0-rc1 (including)	2.0-rc1 (including)
Munin	Munin-monitoring	2.0-rc2 (including)	2.0-rc2 (including)
Munin	Munin-monitoring	2.0-rc3 (including)	2.0-rc3 (including)
Munin	Munin-monitoring	2.0-rc4 (including)	2.0-rc4 (including)
Munin	Munin-monitoring	2.0-rc5 (including)	2.0-rc5 (including)
Munin	Munin-monitoring	2.0-rc6 (including)	2.0-rc6 (including)
Munin	Munin-monitoring	2.0-rc7 (including)	2.0-rc7 (including)
Munin	Munin-monitoring	2.0.0 (including)	2.0.0 (including)
Munin	Munin-monitoring	2.0.1 (including)	2.0.1 (including)
Munin	Munin-monitoring	2.0.2 (including)	2.0.2 (including)
Munin	Munin-monitoring	2.0.3 (including)	2.0.3 (including)
Munin	Munin-monitoring	2.0.4 (including)	2.0.4 (including)
Munin	Ubuntu	devel	*
Munin	Ubuntu	hardy	*
Munin	Ubuntu	lucid	*
Munin	Ubuntu	natty	*
Munin	Ubuntu	oneiric	*
Munin	Ubuntu	precise	*
Munin	Ubuntu	quantal	*
Munin	Ubuntu	upstream	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2012-3512
CWE	https://cwe.mitre.org/data/definitions/264.html

Affected Software

References