Directory traversal vulnerability in Puppet 2.6.x before 2.6.10 and 2.7.x before 2.7.4 allows remote attackers to write X.509 Certificate Signing Request (CSR) to arbitrary locations via (1) a double-encoded key parameter in the URI in 2.7.x, (2) the CN in the Subject of a CSR in 2.6 and 0.25.

Puppet's certificate authority issued Puppet agent certificates capable of impersonating the Puppet master. Compromised or rogue puppet agents could therefore use their certificates for MITM attacks (CVE-2011-3872). 

Note: If you've set the 'certdnsnames' option in your master's puppet.conf file merely installing the updated packages is not sufficient to fix this problem. You need to either pick a new DNS name for the master and reconfigure all agents to use it or re-new certificates on all agents.

Please refer to the documentation in /usr/share/doc/packages/puppet/puppetlabs-cve20113872-0.0.5 for detailed instructions and scripts. 

Puppetlabs' site also provides more information:
http://puppetlabs.com/security/cve/cve-2011-3872/faq/ http://puppetlabs.com/blog/important-security-announcement-altnames-vu lnerability/

--

Directory traversal vulnerability in puppet allowed unauthenticated remote attackers to upload x.509 certificate signing requests to arbitrary locations (CVE-2011-3848)

Puppet was prone to several symlink attacks (CVE-2011-3870, CVE-2011-3869, CVE-2011-3871)

A directory traversal vulnerability in puppet allowed unauthenticated remote attackers to upload x.509 certificate signing requests to arbitrary locations (CVE-2011-3848)

The remote host is affected by the vulnerability described in GLSA-201203-03 (Puppet: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Puppet. Please review       the CVE identifiers referenced below for details.
  Impact :

    A local attacker could gain elevated privileges, or access and modify       arbitrary files.  Furthermore, a remote attacker may be able to spoof a       Puppet Master or write X.509 Certificate Signing Requests to arbitrary       locations.
  Workaround :

    There is no known workaround at this time.

The following security issues have been fixed :

  - Puppet's certificate authority issued Puppet agent     certificates capable of impersonating the Puppet master.
    Compromised or rogue puppet agents could therefore use     their certificates for MITM attacks. (CVE-2011-3872)

    Note: If you've set the 'certdnsnames' option in your     master's puppet.conf file merely installing the updated     packages is not sufficient to fix this problem. You need     to either pick a new DNS name for the master and     reconfigure all agents to use it or re-new certificates     on all agents.

    Please refer to the documentation in     /usr/share/doc/packages/puppet/puppetlabs-cve20113872-0.
    0.5 for detailed instructions and scripts.

    Puppetlabs' site also provides more information:
    http://puppetlabs.com/security/cve/cve-2011-3872/faq/     http://puppetlabs.com/blog/important-security-announceme     nt-altnames-vulnerability/

  - Directory traversal vulnerability in puppet allowed     unauthenticated remote attackers to upload x.509     certificate signing requests to arbitrary locations.
    (CVE-2011-3848)

  - Puppet was prone to several symlink attacks     (CVE-2011-3870 / CVE-2011-3869 / CVE-2011-3871)

Multiple security issues have been discovered in Puppet, a centralized configuration management system. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2011-3848     Kristian Erik Hermansen reported that an unauthenticated     directory traversal could drop any valid X.509     Certificate Signing Request at any location on disk,     with the privileges of the Puppet Master application.

  - CVE-2011-3870     Ricky Zhou discovered a potential local privilege     escalation in the ssh_authorized_keys resource and     theoretically in the Solaris and AIX providers, where     file ownership was given away before it was written,     leading to a possibility for a user to overwrite     arbitrary files as root, if their authorized_keys file     was managed.

  - CVE-2011-3869     A predictable file name in the k5login type leads to the     possibility of symlink attacks which would allow the     owner of the home directory to symlink to anything on     the system, and have it replaced with the'correct'     content of the file, which can lead to a privilege     escalation on puppet runs.

  - CVE-2011-3871     A potential local privilege escalation was found in the
    --edit mode of 'puppet resource' due to a persistent,     predictable file name, which can result in editing an     arbitrary target file, and thus be be tricked into     running that arbitrary file as the invoking user. This     command is most commonly run as root, this leads to a     potential privilege escalation.

Additionally, this update hardens the indirector file backed terminus base class against injection attacks based on trusted path names.

Kristian Erik Hermansen discovered a directory traversal vulnerability in the SSLFile indirection base class. A remote attacker could exploit this to overwrite files with the privileges of the Puppet Master.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75999	openSUSE Security Update : puppet (openSUSE-SU-2011:1288-1)	Nessus	SuSE Local Security Checks	medium
75998	openSUSE Security Update : puppet (openSUSE-SU-2011:1190-1)	Nessus	SuSE Local Security Checks	medium
75715	openSUSE Security Update : puppet (openSUSE-SU-2011:1288-1)	Nessus	SuSE Local Security Checks	medium
75714	openSUSE Security Update : puppet (openSUSE-SU-2011:1190-1)	Nessus	SuSE Local Security Checks	medium
58213	GLSA-201203-03 : Puppet: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
57129	SuSE 11.1 Security Update : puppet (SAT Patch Number 5421)	Nessus	SuSE Local Security Checks	medium
56381	Debian DSA-2314-1 : puppet - multiple vulnerabilities	Nessus	Debian Local Security Checks	medium
56332	Ubuntu 10.04 LTS / 10.10 / 11.04 : puppet vulnerability (USN-1217-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2011-3848

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium