CVE-2012-3512 — Munin vulnerability

CWE-2648 documents6 sources
Severity
7.2HIGHNVD
EPSS
0.1%
top 76.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Munin-monitoring MuninDebian Munin
Timeline
PublishedNov 21
Latest updateMay 17

Description

Munin before 2.0.6 stores plugin state files that run as root in the same group-writable directory as non-root plugins, which allows local users to execute arbitrary code by replacing a state file, as demonstrated using the smart_ plugin.

CVSS vector

AV:L/AC:L/C:C/I:C/A:CExploitability: 3.9 | Impact: 10.0

Affected Packages3 packages

▶debiandebian/munin< munin 2.0.6-1 (bookworm)
▶Debianmunin-monitoring/munin< 2.0.6-1+3

🔴Vulnerability Details

2
GHSA
GHSA-g93j-j4g4-hr9q: Munin before 2↗2022-05-17
▶
OSV
CVE-2012-3512: Munin before 2↗2012-11-21
▶

📋Vendor Advisories

2
Ubuntu
Munin vulnerabilities↗2012-11-05
▶
Debian
CVE-2012-3512: munin - Munin before 2.0.6 stores plugin state files that run as root in the same group-...↗2012
▶

💬Community

3
Bugzilla
CVE-2012-3512 munin: insecure state file handling, munin->root privilege [fedora-all]↗2012-08-21
▶
Bugzilla
CVE-2012-3512 munin: insecure state file handling, munin->root privilege [epel-all]↗2012-08-21
▶
Bugzilla
CVE-2012-3512 munin: insecure state file handling, munin->root privilege↗2012-08-21
▶