Multiple vulnerabilities in Puppet



| Updated: 2022-12-08
Risk Low
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2012-3865
CVE-2012-3866
CWE-ID CWE-22
CWE-264
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Puppet Agent
Server applications / Conferencing, Collaboration and VoIP solutions

Vendor Puppet Labs

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Path traversal

EUVDB-ID: #VU43768

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2012-3865

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf,. A remote authenticated attacker can send a specially crafted HTTP request and remote authenticated users to delete arbitrary files on the puppet master server via a . (dot dot) in a node name.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Puppet Agent:

CPE2.3 External links

https://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html
https://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html
https://puppetlabs.com/security/cve/cve-2012-3865/
https://secunia.com/advisories/50014
https://www.debian.org/security/2012/dsa-2511
https://www.ubuntu.com/usn/USN-1506-1
https://bugzilla.redhat.com/show_bug.cgi?id=839131
https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f
https://github.com/puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU43769

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2012-3866

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Puppet Agent:

CPE2.3 External links

https://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html
https://puppetlabs.com/security/cve/cve-2012-3866/
https://secunia.com/advisories/50014
https://www.debian.org/security/2012/dsa-2511
https://www.ubuntu.com/usn/USN-1506-1
https://bugzilla.redhat.com/show_bug.cgi?id=839135
https://github.com/puppetlabs/puppet/commit/fd44bf5e6d0d360f6a493d663b653c121fa83c3f


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###