#2009-019 Ganeti path sanitization errors Description: Ganeti, an open source virtualisation manager, suffers from an input validation bug that poses a security risk. The vulnerability applies to the commands submitted, either locally via gnt-* commands or remotely via the HTTP API, to the machine acting as a cluster master. Validation for a file path argument is missing resulting in arbitrary code execution, local exploitation applies to any user with rights to execute ganeti commands while remote exploitation applies to configured users authenticated over the ganeti RAPI. While the local exploitation is a non-issue for the root user, which can execute arbitrary commands in any case, it affects local non-root users which are allowed to execute gnt-* commands via sudo or other suid wrappers. Affected version: Ganeti >= 1.2.4 (local), >= 2.0.0 (remote) Fixed version: Ganeti >= 1.2.9, >= 2.0.5, >= 2.1.0~rc2 Credit: vulnerability report, PoC and patches received from Ganeti authors Iustin Pop and Michael Hanselmann, Google Inc. CVE: CVE-2009-4261 CVE: N/A Timeline: 2009-12-07: vulnerability report received 2009-12-08: contacted affected vendors 2009-12-17: ganeti 1.2.9, 2.0.5, 2.1.0~rc2 released 2009-12-17: advisory published References: http://groups.google.com/group/ganeti/browse_thread/thread/cbce23d89103a 8d2 Permalink: http://www.ocert.org/advisories/ocert-2009-019.html