Puppet 0.24.x before 0.24.9 and 0.25.x before 0.25.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/daemonout, (2) /tmp/puppetdoc.txt, (3) /tmp/puppetdoc.tex, or (4) /tmp/puppetdoc.aux temporary file.

The remote host is affected by the vulnerability described in GLSA-201203-03 (Puppet: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Puppet. Please review       the CVE identifiers referenced below for details.
  Impact :

    A local attacker could gain elevated privileges, or access and modify       arbitrary files.  Furthermore, a remote attacker may be able to spoof a       Puppet Master or write X.509 Certificate Signing Requests to arbitrary       locations.
  Workaround :

    There is no known workaround at this time.

pupped created temporary files with fixed names. Local attacks could exploit that to install symlinks that overwrite files of the victim.
(CVE-2010-0156)

The update from 0.24.x to 0.25.x brings many, many changes and improvements to puppet. The upstream release notes cover them in detail: http://reductivelabs.com/trac/puppet/wiki/ReleaseNotes Of note is that 0.25.x clients do not work with 0.24.x masters, so it is important to update the master before or at the same time as clients.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

pupped created temporary files with fixed names. Local attacks could exploit that to install symlinks that overwrite files of the victim (CVE-2010-0156).

It was discovered that Puppet did not drop supplementary groups when being run as a different user. A local user may be able to use this flaw to bypass security restrictions and gain access to restricted files. (CVE-2009-3564)

It was discovered that Puppet did not correctly handle temporary files. A local user can exploit this flaw to bypass security restrictions and overwrite arbitrary files. (CVE-2010-0156).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
58213	GLSA-201203-03 : Puppet: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
50959	SuSE 11 Security Update : puppet (SAT Patch Number 2113)	Nessus	SuSE Local Security Checks	low
47249	Fedora 12 : puppet-0.25.4-1.fc12 (2010-1372)	Nessus	Fedora Local Security Checks	low
47231	Fedora 11 : puppet-0.25.4-1.fc11 (2010-1079)	Nessus	Fedora Local Security Checks	low
46782	openSUSE Security Update : puppet (openSUSE-SU-2010:0306-1)	Nessus	SuSE Local Security Checks	low
46781	openSUSE Security Update : puppet (openSUSE-SU-2010:0306-1)	Nessus	SuSE Local Security Checks	low
45342	Ubuntu 9.10 : puppet vulnerabilities (USN-917-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2010-0156

medium

Tenable Plugins

medium

low

low

low

low

low

medium