CVE-2012-3537

The Crowbar Ohai plugin (chef/cookbooks/ohai/files/default/plugins/crowbar.rb) in the Deployer Barclamp in Crowbar, possibly 1.4 and earlier, allows local users to execute arbitrary shell commands via vectors related to "insecure handling of tmp files" and predictable file names.

• CWE-264

• http://osvdb.org/84955
• http://secunia.com/advisories/50442Vendor Advisory
• http://www.openwall.com/lists/oss-security/2012/08/27/5
• http://www.openwall.com/lists/oss-security/2012/08/27/7
• http://www.securityfocus.com/bid/55240
• https://bugzilla.novell.com/show_bug.cgi?id=774967
• https://exchange.xforce.ibmcloud.com/vulnerabilities/78041
• https://github.com/SUSE-Cloud/barclamp-deployer/commit/5ea8d4ddaa4cb1ce834d36889f0fe7ac0d617bc8Exploit, Patch
• https://github.com/SUSE-Cloud/barclamp-deployer/commit/b6454268a067fc77ff5de82057b5b53b3cc38b87Exploit, Patch
• https://github.com/dellcloudedge/barclamp-deployer/pull/57
• http://osvdb.org/84955
• http://secunia.com/advisories/50442Vendor Advisory
• http://www.openwall.com/lists/oss-security/2012/08/27/5
• http://www.openwall.com/lists/oss-security/2012/08/27/7
• http://www.securityfocus.com/bid/55240
• https://bugzilla.novell.com/show_bug.cgi?id=774967
• https://exchange.xforce.ibmcloud.com/vulnerabilities/78041
• https://github.com/SUSE-Cloud/barclamp-deployer/commit/5ea8d4ddaa4cb1ce834d36889f0fe7ac0d617bc8Exploit, Patch
• https://github.com/SUSE-Cloud/barclamp-deployer/commit/b6454268a067fc77ff5de82057b5b53b3cc38b87Exploit, Patch
• https://github.com/dellcloudedge/barclamp-deployer/pull/57

Published

Sep 5, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-3531Cross-site scripting (XSS) vulnerability in the Install Tool…
• CVE-2012-3532Cross-site request forgery (CSRF) vulnerability in the GateI…
• CVE-2012-3533The python SDK before 3.1.0.6 and CLI before 3.1.0.8 for oVi…
• CVE-2012-3534GNU Gatekeeper before 3.1 does not limit the number of conne…
• CVE-2012-3535Heap-based buffer overflow in OpenJPEG 1.5.0 and earlier all…
• CVE-2012-3536Two XSS vulnerabilities were fixed in message list and view …
• CVE-2012-3538Pulp in Red Hat CloudForms before 1.1 logs administrative pa…
• CVE-2012-3539Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2012-3540Open redirect vulnerability in views/auth_forms.py in OpenSt…
• CVE-2012-3541Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2012-3542OpenStack Keystone, as used in OpenStack Folsom before folso…
• CVE-2012-3543mono 2.10.x ASP.NET Web Form Hash collision DoS7.5