Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with an authorized SSL key and certain permissions on the puppet master to read arbitrary files via a symlink attack in conjunction with a crafted REST request for a file in a filebucket.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1542 advisory.

    Red Hat CloudForms is an on-premise hybrid cloud     Infrastructure-as-a-Service (IaaS) product that lets you create and manage     private and public clouds.

    Multiple input validation vulnerabilities were discovered in     rubygem-activerecored. A remote attacker could possibly use these flaws     to perform an SQL injection attack against an application using     rubygem-activerecord. (CVE-2012-2660, CVE-2012-2661, CVE-2012-2694,     CVE-2012-2695)

    Multiple cross-site scripting (XSS) flaws were found in rubygem-actionpack.
    A remote attacker could use these flaws to conduct XSS attacks against     users of an application using rubygem-actionpack. (CVE-2012-3463,     CVE-2012-3464, CVE-2012-3465)

    A flaw was found in the HTTP digest authentication implementation in     rubygem-actionpack. A remote attacker could use this flaw to cause a     denial of service of an application using rubygem-actionpack and digest     authentication. (CVE-2012-3424)

    An input validation flaw was found in rubygem-mail's Exim and Sendmail     delivery methods. A remote attacker could use this flaw to execute     arbitrary commands with the privileges of an application using     rubygem-mail. (CVE-2012-2140)

    A directory traversal flaw was found in rubygem-mail's file delivery     method. A remote attacker could use this flaw to send a mail with a     specially crafted To: header and write to files with the privileges of     an application using rubygem-mail. (CVE-2012-2139)

    Puppet was updated to version 2.6.17, which fixes multiple security     issues. These issues are not exposed by CloudForms. (CVE-2012-1986,     CVE-2012-1987, CVE-2012-1988, CVE-2012-3864, CVE-2012-3865, CVE-2012-3867)

    Red Hat would like to thank Puppet Labs for reporting CVE-2012-1988,     CVE-2012-1986, CVE-2012-1987, CVE-2012-3864, CVE-2012-3865, and     CVE-2012-3867.

    Users are advised to upgrade to these CloudForms Commons packages, which     resolve these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- Fixed bnc#747657: CVE-2012-1053, CVE-2012-1054: improper     privilege dropping and file handling flaws This was done     by updating to the new version in stable branch. The     stable branch receives only security fixes and this     update does not provide any new features.

  - Fixed bnc#755869 CVE-2012-1988: Filebucket arbitrary     code execution

  - Fixed bnc#755872 CVE-2012-1986: Arbitrary File Read

  - Fixed bnc#755870 CVE-2012-1987: Denial of Service

  - Fixed bnc#755871 CVE-2012-1989: Arbitrary File Write

puppet was prone to several security issues

This update fixes the following issues :

  - Filebucket arbitrary file read. (CVE-2011-1986)

  - Filebucket DoS. (CVE-2012-1987)

  - Filebucket arbitrary code execution. (CVE-2012-1988)

  - insecure handling of temporary files. (CVE-2012-1989)

The remote host is affected by the vulnerability described in GLSA-201208-02 (Puppet: Multiple vulnerabilities)

    Multiple vulnerabilities have been found in Puppet:
      Puppet uses predictable file names for temporary files         (CVE-2012-1906).
      REST requests for a file in a remote filebucket are not handled         properly by overriding filebucket storage locations (CVE-2012-1986).
      REST requests for a file in a remote filebucket are not handled         properly by reading streams or writing files on the Puppet master's         file system (CVE-2012-1987).
      File name paths are not properly sanitized from bucket requests         (CVE-2012-1988).
      The Telnet utility in Puppet does not handle temporary files securely         (CVE-2012-1989).
  Impact :

    A local attacker with access to agent SSL keys could possibly execute       arbitrary code with the privileges of the process, cause a Denial of       Service condition, or perform symlink attacks to overwrite or read       arbitrary files on the Puppet master.
  Workaround :

    There is no known workaround at this time.

With Fedora 17 using ruby-1.9.3, an update to puppet-2.7, which has improved support for ruby-1.9, is required. Note that ruby-1.9 is not fully supported in the puppet-2.7 series. Where possible, patches from the next upstream release branch will be backported to improve ruby-1.9 compatibility.

Also note that there will likely be issues when connecting to a puppet-2.6 master. This is unavoidable for the moment. Normally all Fedora and EPEL branches are kept in sync to avoid this problem. At this time, a decision to move all branches to 2.7 has not been made.

This update obsoletes puppet-2.6.16, which fixed several security issues recently found in puppet related to filebucket functionality.
For full details, refer to the upstream release notes :

http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.7.13

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes several security issues recently found in puppet related to filebucket functionality. For full details, refer to the upstream release notes :

http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in Puppet, a centralized configuration management system. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2012-1906     Puppet is using predictable temporary file names when     downloading Mac OS X package files. This allows a local     attacker to either overwrite arbitrary files on the     system or to install an arbitrary package.

  - CVE-2012-1986     When handling requests for a file from a remote     filebucket, Puppet can be tricked into overwriting its     defined location for filebucket storage. This allows an     authorized attacker with access to the Puppet master to     read arbitrary files.

  - CVE-2012-1987     Puppet is incorrectly handling filebucket store     requests. This allows an attacker to perform denial of     service attacks against Puppet by resource exhaustion.

  - CVE-2012-1988     Puppet is incorrectly handling filebucket requests. This     allows an attacker with access to the certificate on the     agent and an unprivileged account on Puppet master to     execute arbitrary code via crafted file path names and     making a filebucket request.

It was discovered that Puppet used a predictable filename when downloading Mac OS X package files. A local attacker could exploit this to overwrite arbitrary files. (CVE-2012-1906)

It was discovered that Puppet incorrectly handled filebucket retrieval requests. A local attacker could exploit this to read arbitrary files.
(CVE-2012-1986)

It was discovered that Puppet incorrectly handled filebucket store requests. A local attacker could exploit this to perform a denial of service via resource exhaustion. (CVE-2012-1987)

It was discovered that Puppet incorrectly handled filebucket requests.
A local attacker could exploit this to execute arbitrary code via a crafted file path. (CVE-2012-1988)

It was discovered that Puppet used a predictable filename for the Telnet connection log file. A local attacker could exploit this to overwrite arbitrary files. This issue only affected Ubuntu 11.10.
(CVE-2012-1989).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities exist in puppet that can result in arbitrary code execution, arbitrary file read access, denial of service, and arbitrary file write access. Please review the details in each of the CVEs for additional information.

ID	Name	Product	Family	Severity
193969	RHEL 6 : CloudForms Commons 1.1 (RHSA-2012:1542)	Nessus	Red Hat Local Security Checks	high
74671	openSUSE Security Update : puppet (openSUSE-SU-2012:0835-1)	Nessus	SuSE Local Security Checks	medium
74620	openSUSE Security Update : puppet (openSUSE-SU-2012:0608-1)	Nessus	SuSE Local Security Checks	medium
69682	Amazon Linux AMI : puppet (ALAS-2012-75)	Nessus	Amazon Linux Local Security Checks	low
64217	SuSE 11.1 Security Update : puppet (SAT Patch Number 6115)	Nessus	SuSE Local Security Checks	high
61541	GLSA-201208-02 : Puppet: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
59000	Fedora 17 : puppet-2.7.13-1.fc17 (2012-6674)	Nessus	Fedora Local Security Checks	medium
58911	Fedora 15 : puppet-2.6.16-1.fc15 (2012-6055)	Nessus	Fedora Local Security Checks	medium
58909	Fedora 16 : puppet-2.6.16-1.fc16 (2012-5999)	Nessus	Fedora Local Security Checks	medium
58753	Debian DSA-2451-1 : puppet - several vulnerabilities	Nessus	Debian Local Security Checks	medium
58680	Ubuntu 10.04 LTS / 11.04 / 11.10 : puppet vulnerabilities (USN-1419-1)	Nessus	Ubuntu Local Security Checks	medium
58670	FreeBSD : puppet -- Multiple Vulnerabilities (607d2108-a0e4-423a-bf78-846f2a8f01b0)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2012-1986

low

Tenable Plugins

high

medium

medium

low

high

medium

medium

medium

medium

medium

medium

medium