Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick enabled, via a crafted request for a report.

Various security issues were fixed in puppet.

CVE-2013-1655 CVE-2013-2275 CVE-2013-1640 CVE-2013-1652 CVE-2013-1653 CVE-2013-1654 CVE-2013-1655 CVE-2013-2274 CVE-2013-2275

The remote host is affected by the vulnerability described in GLSA-201308-04 (Puppet: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Puppet. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

puppet has been updated to fix 2.6.18 multiple vulnerabilities and bugs.

  - (#19391) Find the catalog for the specified node name

  - Don't assume master supports SSLv2

  - Don't require openssl client to return 0 on failure

  - Display SSL messages so we can match our regex

  - Don't assume puppetbindir is defined

  - Remove unnecessary rubygems require

  - Run openssl from windows when trying to downgrade master

  - Separate tests for same CVEs into separate files

  - Fix order-dependent test failure in rest_authconfig_spec

  - Always read request body when using Rack

  - (#19392) (CVE-2013-1653) Fix acceptance test to catch     unvalidated model on 2.6

  - (#19392) (CVE-2013-1653) Validate indirection model in     save handler

  - Acceptance tests for CVEs 2013 (1640, 1652, 1653, 1654,     2274, 2275)

  - (#19531) (CVE-2013-2275) Only allow report save from the     node matching the certname

  - (#19391) Backport Request#remote? method

  - (#8858) Explicitly set SSL peer verification mode.

  - (#8858) Refactor tests to use real HTTP objects

  - (#19392) (CVE-2013-1653) Validate instances passed to     indirector

  - (#19391) (CVE-2013-1652) Disallow use_node compiler     parameter for remote requests

  - (#19151) Reject SSLv2 SSL handshakes and ciphers

  - (#14093) Restore access to the filename in the template

  - (#14093) Remove unsafe attributes from TemplateWrapper

Moses Mendoza reports :

A vulnerability found in Puppet could allow an authenticated client to cause the master to execute arbitrary code while responding to a catalog request. Specifically, in order to exploit the vulnerability, the puppet master must be made to invoke the 'template' or 'inline_template' functions during catalog compilation.

A vulnerability found in Puppet could allow an authenticated client to connect to a puppet master and perform unauthorized actions.
Specifically, given a valid certificate and private key, an agent could retrieve catalogs from the master that it is not authorized to access or it could poison the puppet master's caches for any puppet-generated data that supports caching such as catalogs, nodes, facts, and resources. The extent and severity of this vulnerability varies depending on the specific configuration of the master: for example, whether it is using storeconfigs or not, which version, whether it has access to the cache or not, etc.

A vulnerability has been found in Puppet that could allow a client negotiating a connection to a master to downgrade the master's SSL protocol to SSLv2. This protocol has been found to contain design weaknesses. This issue only affects systems running older versions (pre 1.0.0) of openSSL. Newer versions explicitly disable SSLv2.

A vulnerability found in Puppet could allow an authenticated client to execute arbitrary code on a puppet master that is running in the default configuration, or an agent with `puppet kick` enabled.
Specifically, a properly authenticated and connected puppet agent could be made to construct an HTTP PUT request for an authorized report that actually causes the execution of arbitrary code on the master.

This vulnerability affects puppet masters 0.25.0 and above. By default, auth.conf allows any authenticated node to submit a report for any other node. This can cause issues with compliance. The defaults in auth.conf have been changed.

Multiple vulnerabilities were discovered in Puppet, a centralized configuration management system.

  - CVE-2013-1640     An authenticated malicious client may request its     catalog from the puppet master, and cause the puppet     master to execute arbitrary code. The puppet master must     be made to invoke the 'template' or 'inline_template'     functions during catalog compilation.

  - CVE-2013-1652     An authenticated malicious client may retrieve catalogs     from the puppet master that it is not authorized to     access. Given a valid certificate and private key, it is     possible to construct an HTTP GET request that will     return a catalog for an arbitrary client.

  - CVE-2013-1653     An authenticated malicious client may execute arbitrary     code on Puppet agents that accept kick connections.
    Puppet agents are not vulnerable in their default     configuration. However, if the Puppet agent is     configured to listen for incoming connections, e.g.
    listen = true, and the agent's auth.conf allows access     to the 'run' REST endpoint, then an authenticated client     can construct an HTTP PUT request to execute arbitrary     code on the agent. This issue is made worse by the fact     that puppet agents typically run as root.

  - CVE-2013-1654     A bug in Puppet allows SSL connections to be downgraded     to SSLv2, which is known to contain design flaw     weaknesses. This affects SSL connections between puppet     agents and master, as well as connections that puppet     agents make to third-party servers that accept SSLv2     connections. Note that SSLv2 is disabled since OpenSSL     1.0.

  - CVE-2013-1655     An unauthenticated malicious client may send requests to     the puppet master, and have the master load code in an     unsafe manner. It only affects users whose puppet     masters are running ruby 1.9.3 and above.

  - CVE-2013-2274     An authenticated malicious client may execute arbitrary     code on the puppet master in its default configuration.
    Given a valid certificate and private key, a client can     construct an HTTP PUT request that is authorized to save     the client's own report, but the request will actually     cause the puppet master to execute arbitrary code.

  - CVE-2013-2275     The default auth.conf allows an authenticated node to     submit a report for any other node, which is a problem     for compliance. It has been made more restrictive by     default so that a node is only allowed to save its own     report.

ID	Name	Product	Family	Severity
74952	openSUSE Security Update : puppet (openSUSE-2013-295)	Nessus	SuSE Local Security Checks	high
69464	GLSA-201308-04 : Puppet: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
65796	SuSE 11.2 Security Update : puppet (SAT Patch Number 7526)	Nessus	SuSE Local Security Checks	high
65540	FreeBSD : puppet26 -- multiple vulnerabilities (04042f95-14b8-4382-a8b9-b30e365776cf)	Nessus	FreeBSD Local Security Checks	high
65228	Debian DSA-2643-1 : puppet - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2013-2274

medium

Tenable Plugins

high

high

high

high

high