#VU42027 Permissions, Privileges, and Access Controls in Puppet Agent - CVE-2011-0528

Vulnerability identifier: #VU42027

Vulnerability risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2011-0528

CWE-ID: CWE-264

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Puppet Agent
Server applications / Conferencing, Collaboration and VoIP solutions

Vendor: Puppet Labs

Description

The vulnerability allows a remote #AU# to read and manipulate data.

Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources of other nodes via unspecified vectors.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Puppet Agent:

---

External links
https://www.mail-archive.com/puppet-users%40googlegroups.com/msg16429.html
https://www.openwall.com/lists/oss-security/2011/01/27/6
https://www.openwall.com/lists/oss-security/2011/01/31/5
https://www.ubuntu.com/usn/USN-1365-1

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.