An attacker exploits a configuration management system so that malicious
						logic is inserted into a software products build, update or deployed
						environment. If an attacker can control the elements included in a product's
						configuration management for build they can potentially replace, modify or
						insert code files containing malicious logic. If an attacker can control
						elements of a product's ongoing operational configuration management
						baseline they can potentially force clients recieving updates from the
						system to install insecure software when recieving updates from the server.
						Configuration management servers operate on the basis of a client pool,
						instructing each client on which software to install. In some cases the
						configuration management server will automate the software installation
						process. A malicious insider or an attacker who has compromised the server
						can alter the software baseline that clients must install, allowing the
						attacker to compromise a large number of satallite machines using the
						configuration management system. If an attacker can control elements of a
						product's configuration management for its deployed environment they can
						potentially alter fundamental security properties of the system based on
						assumptions that secure configurations are in place.