Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:1284 advisory.

    Puppet allows provisioning, patching, and configuration of clients to be     managed and automated.

    A flaw was found in the way Puppet handled YAML content during     Representational State Transfer (REST) API calls. An attacker could     construct a request containing a crafted YAML payload that would cause the     Puppet master to execute arbitrary code. (CVE-2013-3567)

    It was found that resource_type requests could be used to cause the Puppet     master to load and run Ruby files from anywhere on the file system. In     non-default configurations, a local user on the Puppet master server could     use this flaw to have arbitrary Ruby code executed with the privileges of     the Puppet master. (CVE-2013-4761)

    It was found that Puppet Module Tool (that is, running puppet module     commands from the command line) applied incorrect permissions to installed     modules. If a malicious, local user had write access to the Puppet module     directory, they could use this flaw to modify the modules and therefore     execute arbitrary code with the privileges of the Puppet master.
    (CVE-2013-4956)

    Red Hat would like to thank Puppet Labs for reporting these issues.
    Upstream acknowledges Ben Murphy as the original reporter of CVE-2013-3567.

    These ruby193-puppet packages are used by Foreman, which provides     facilities for rapidly deploying Red Hat OpenStack 3.0. In this use case,     Puppet master is used and exposed to these issues. Note that Foreman is     provided as a Technology Preview. For more information on the scope and     nature of support for items marked as Technology Preview, refer to     https://access.redhat.com/support/offerings/techpreview/

    Users of Red Hat OpenStack 3.0 are advised to upgrade to these updated     packages, which correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A potential remote code execution via YAML was fixed in puppet.
(CVE-2013-3567)

According to its self-reported version number, the Puppet install on the remote host has a remote code execution vulnerability. When making REST API calls, the puppet master takes YAML from an untrusted client, deserializes it, and then calls methods on the resulting object. A YAML payload can be crafted to cause the deserialization to construct an instance of any class available in the ruby process, which allows an attacker to execute code contained in the payload.

The remote host is affected by the vulnerability described in GLSA-201308-04 (Puppet: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Puppet. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

This puppet update fixes a remote code execution issue :

  - Unauthenticated Remote Code Execution Vulnerability with     YAML and REST API calls (bug#825878, CVE-2013-3567)

Updated puppet packages fix remote code execution vulnerability

When making REST api calls, the puppet master takes YAML from an untrusted client, deserializes it, and then calls methods on the resulting object. A YAML payload can be crafted to cause the deserialization to construct an instance of any class available in the ruby process, which allows an attacker to execute code contained in the payload (CVE-2013-3567).

It was discovered that puppet, a centralized configuration management system, did not correctly handle YAML payloads. A remote attacker could use a specially crafted payload to execute arbitrary code on the puppet master.

Puppet Developers report :

When making REST api calls, the puppet master takes YAML from an untrusted client, deserializes it, and then calls methods on the resulting object. A YAML payload can be crafted to cause the deserialization to construct an instance of any class available in the ruby process, which allows an attacker to execute code contained in the payload.

It was discovered that Puppet incorrectly handled YAML payloads. An attacker on an untrusted client could use this issue to execute arbitrary code on the master.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
193828	RHEL 6 : ruby193-puppet (RHSA-2013:1284)	Nessus	Red Hat Local Security Checks	high
75125	openSUSE Security Update : puppet (openSUSE-SU-2013:1370-1)	Nessus	SuSE Local Security Checks	high
70662	Puppet Unauthenticated Remote Code Execution	Nessus	CGI abuses	high
69771	Amazon Linux AMI : puppet (ALAS-2013-213)	Nessus	Amazon Linux Local Security Checks	high
69464	GLSA-201308-04 : Puppet: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
69233	SuSE 11.2 / 11.3 Security Update : puppet / puppet, puppet-server (SAT Patch Numbers 8131 / 8132)	Nessus	SuSE Local Security Checks	high
67104	Mandriva Linux Security Advisory : puppet (MDVSA-2013:186)	Nessus	Mandriva Local Security Checks	high
67100	Debian DSA-2715-1 : puppet - code execution	Nessus	Debian Local Security Checks	high
66966	FreeBSD : puppet -- Unauthenticated Remote Code Execution Vulnerability (b162b218-c547-4ba2-ae31-6fdcb61bc763)	Nessus	FreeBSD Local Security Checks	high
66924	Ubuntu 12.04 LTS / 12.10 / 13.04 : puppet vulnerability (USN-1886-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2013-3567

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high