#VU38511 Format string error in Puppet Enterprise - CVE-2016-5716

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU38511

#VU38511 Format string error in Puppet Enterprise - CVE-2016-5716

Published: August 9, 2017 / Updated: August 8, 2020


Vulnerability identifier: #VU38511
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2016-5716
CWE-ID: CWE-134
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
Puppet Enterprise
Software vendor:
Puppet Labs

Description

The vulnerability allows a remote authenticated user to execute arbitrary code.

The console in Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0 includes unsafe string reads that potentially allows for remote code execution on the console node.


Remediation

Install update from vendor's website.

External links