Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files.

Puppet's certificate authority issued Puppet agent certificates capable of impersonating the Puppet master. Compromised or rogue puppet agents could therefore use their certificates for MITM attacks (CVE-2011-3872). 

Note: If you've set the 'certdnsnames' option in your master's puppet.conf file merely installing the updated packages is not sufficient to fix this problem. You need to either pick a new DNS name for the master and reconfigure all agents to use it or re-new certificates on all agents.

Please refer to the documentation in /usr/share/doc/packages/puppet/puppetlabs-cve20113872-0.0.5 for detailed instructions and scripts. 

Puppetlabs' site also provides more information:
http://puppetlabs.com/security/cve/cve-2011-3872/faq/ http://puppetlabs.com/blog/important-security-announcement-altnames-vu lnerability/

--

Directory traversal vulnerability in puppet allowed unauthenticated remote attackers to upload x.509 certificate signing requests to arbitrary locations (CVE-2011-3848)

Puppet was prone to several symlink attacks (CVE-2011-3870, CVE-2011-3869, CVE-2011-3871)

Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files.

Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorized_keys file.

Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file.

The remote host is affected by the vulnerability described in GLSA-201203-03 (Puppet: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Puppet. Please review       the CVE identifiers referenced below for details.
  Impact :

    A local attacker could gain elevated privileges, or access and modify       arbitrary files.  Furthermore, a remote attacker may be able to spoof a       Puppet Master or write X.509 Certificate Signing Requests to arbitrary       locations.
  Workaround :

    There is no known workaround at this time.

The following security issues have been fixed :

  - Puppet's certificate authority issued Puppet agent     certificates capable of impersonating the Puppet master.
    Compromised or rogue puppet agents could therefore use     their certificates for MITM attacks. (CVE-2011-3872)

    Note: If you've set the 'certdnsnames' option in your     master's puppet.conf file merely installing the updated     packages is not sufficient to fix this problem. You need     to either pick a new DNS name for the master and     reconfigure all agents to use it or re-new certificates     on all agents.

    Please refer to the documentation in     /usr/share/doc/packages/puppet/puppetlabs-cve20113872-0.
    0.5 for detailed instructions and scripts.

    Puppetlabs' site also provides more information:
    http://puppetlabs.com/security/cve/cve-2011-3872/faq/     http://puppetlabs.com/blog/important-security-announceme     nt-altnames-vulnerability/

  - Directory traversal vulnerability in puppet allowed     unauthenticated remote attackers to upload x.509     certificate signing requests to arbitrary locations.
    (CVE-2011-3848)

  - Puppet was prone to several symlink attacks     (CVE-2011-3870 / CVE-2011-3869 / CVE-2011-3871)

The following vulnerabilities have been discovered and fixed :

  - CVE-2011-3870, a symlink attack via a user's SSH     authorized_keys file

    - CVE-2011-3869, a symlink attack via a user's .k5login       file

    - CVE-2011-3871, a privilege escalation attack via the       temp file used by the puppet resource application

    - A low-risk file indirector injection attack

Further details can be found in the upstream announcement :

http://groups.google.com/group/puppet-announce/browse_thread/thread/91 e3b46d2328a1cb A vulnerability was discovered in puppet that would allow an attacker to install a valid X509 Certificate Signing Request at any location on disk, with the privileges of the Puppet Master application. For Fedora and EPEL, this is the puppet user.

Further details can be found in the upstream announcement :

http://groups.google.com/group/puppet-users/browse_thread/thread/e57ce 2740feb9406

Unless you enable puppet's listen mode on clients, only the puppet master is vulnerable to this issue. A vulnerability was discovered in puppet that would allow an attacker to install a valid X509 Certificate Signing Request at any location on disk, with the privileges of the Puppet Master application. For Fedora and EPEL, this is the puppet user.

Further details can be found in the upstream announcement :

http://groups.google.com/group/puppet-users/browse_thread/thread/e57ce 2740feb9406

Unless you enable puppet's listen mode on clients, only the puppet master is vulnerable to this issue. A vulnerability was discovered in puppet that would allow an attacker to install a valid X509 Certificate Signing Request at any location on disk, with the privileges of the Puppet Master application. For Fedora and EPEL, this is the puppet user.

Further details can be found in the upstream announcement :

http://groups.google.com/group/puppet-users/browse_thread/thread/e57ce 2740feb9406

Unless you enable puppet's listen mode on clients, only the puppet master is vulnerable to this issue. A vulnerability was discovered in puppet that would allow an attacker to install a valid X509 Certificate Signing Request at any location on disk, with the privileges of the Puppet Master application. For Fedora and EPEL, this is the puppet user.

Further details can be found in the upstream announcement :

http://groups.google.com/group/puppet-users/browse_thread/thread/e57ce 2740feb9406

Unless you enable puppet's listen mode on clients, only the puppet master is vulnerable to this issue. A vulnerability was discovered in puppet that would allow an attacker to install a valid X509 Certificate Signing Request at any location on disk, with the privileges of the Puppet Master application. For Fedora and EPEL, this is the puppet user.

Further details can be found in the upstream announcement :

http://groups.google.com/group/puppet-users/browse_thread/thread/e57ce 2740feb9406

Unless you enable puppet's listen mode on clients, only the puppet master is vulnerable to this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-1223-1 fixed vulnerabilities in Puppet. A regression was found on Ubuntu 10.04 LTS that caused permission denied errors when managing SSH authorized_keys files with Puppet. This update fixes the problem.

We apologize for the inconvenience.

It was discovered that Puppet unsafely opened files when the k5login type is used to manage files. A local attacker could exploit this to overwrite arbitrary files which could be used to escalate privileges.
(CVE-2011-3869)

Ricky Zhou discovered that Puppet did not drop privileges when creating SSH authorized_keys files. A local attacker could exploit this to overwrite arbitrary files as root.
(CVE-2011-3870)

It was discovered that Puppet used a predictable filename when using the --edit resource. A local attacker could exploit this to edit arbitrary files or run arbitrary code as the user invoking the program, typically root.
(CVE-2011-3871).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues have been discovered in Puppet, a centralized configuration management system. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2011-3848     Kristian Erik Hermansen reported that an unauthenticated     directory traversal could drop any valid X.509     Certificate Signing Request at any location on disk,     with the privileges of the Puppet Master application.

  - CVE-2011-3870     Ricky Zhou discovered a potential local privilege     escalation in the ssh_authorized_keys resource and     theoretically in the Solaris and AIX providers, where     file ownership was given away before it was written,     leading to a possibility for a user to overwrite     arbitrary files as root, if their authorized_keys file     was managed.

  - CVE-2011-3869     A predictable file name in the k5login type leads to the     possibility of symlink attacks which would allow the     owner of the home directory to symlink to anything on     the system, and have it replaced with the'correct'     content of the file, which can lead to a privilege     escalation on puppet runs.

  - CVE-2011-3871     A potential local privilege escalation was found in the
    --edit mode of 'puppet resource' due to a persistent,     predictable file name, which can result in editing an     arbitrary target file, and thus be be tricked into     running that arbitrary file as the invoking user. This     command is most commonly run as root, this leads to a     potential privilege escalation.

Additionally, this update hardens the indirector file backed terminus base class against injection attacks based on trusted path names.

It was discovered that Puppet unsafely opened files when the k5login type is used to manage files. A local attacker could exploit this to overwrite arbitrary files which could be used to escalate privileges.
(CVE-2011-3869)

Ricky Zhou discovered that Puppet did not drop privileges when creating SSH authorized_keys files. A local attacker could exploit this to overwrite arbitrary files as root. (CVE-2011-3870)

It was discovered that Puppet used a predictable filename when using the --edit resource. A local attacker could exploit this to edit arbitrary files or run arbitrary code as the user invoking the program, typically root. (CVE-2011-3871).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75999	openSUSE Security Update : puppet (openSUSE-SU-2011:1288-1)	Nessus	SuSE Local Security Checks	medium
75715	openSUSE Security Update : puppet (openSUSE-SU-2011:1288-1)	Nessus	SuSE Local Security Checks	medium
69570	Amazon Linux AMI : puppet (ALAS-2011-11)	Nessus	Amazon Linux Local Security Checks	medium
58213	GLSA-201203-03 : Puppet: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
57129	SuSE 11.1 Security Update : puppet (SAT Patch Number 5421)	Nessus	SuSE Local Security Checks	medium
56517	Fedora 15 : puppet-2.6.6-3.fc15 (2011-13636)	Nessus	Fedora Local Security Checks	medium
56516	Fedora 14 : puppet-2.6.6-3.fc14 (2011-13633)	Nessus	Fedora Local Security Checks	medium
56515	Fedora 16 : puppet-2.6.6-3.fc16 (2011-13623)	Nessus	Fedora Local Security Checks	medium
56406	Ubuntu 10.04 LTS : puppet regression (USN-1223-2)	Nessus	Ubuntu Local Security Checks	medium
56381	Debian DSA-2314-1 : puppet - multiple vulnerabilities	Nessus	Debian Local Security Checks	medium
56375	Ubuntu 10.04 LTS / 10.10 / 11.04 : puppet vulnerabilities (USN-1223-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2011-3871

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium