SB2014030902 - Multiple vulnerabilities in Puppet Enterprise

Description

This security bulletin contains information about 2 vulnerabilities.

1) Improper Authentication (CVE-ID: CVE-2013-4966)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The master external node classification script in Puppet Enterprise before 3.2.0 does not verify the identity of consoles, which allows remote attackers to create arbitrary classifications on the master by spoofing a console.

2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2013-4971)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

Puppet Enterprise before 3.2.0 does not properly restrict access to node endpoints in the console, which allows remote attackers to obtain sensitive information via unspecified vectors.

Remediation

Install update from vendor's website.

References

• http://puppetlabs.com/security/cve/cve-2013-4966
• http://www.securitytracker.com/id/1029873
• http://puppetlabs.com/security/cve/cve-2013-4971