Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3308-1 advisory.

    Dennis Rowe discovered that Puppet incorrectly handled the search path. A local attacker could use this     issue to possibly execute arbitrary code. (CVE-2014-3248)

    It was discovered that Puppet incorrectly handled YAML deserialization. A remote attacker could possibly     use this issue to execute arbitrary code on the master. This update is incompatible with agents older than     3.2.2. (CVE-2017-2295)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Solaris system is missing necessary patches to address security updates :

  - Untrusted search path vulnerability in Puppet Enterprise     2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before     3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before     1.3.4, and Mcollective before 2.5.2, when running with     Ruby 1.9.1 or earlier, allows local users to gain     privileges via a Trojan horse file in the current     working directory, as demonstrated using (1)     rubygems/defaults/ operating_system.rb, (2) Win32API.rb,     (3) Win32API.so, (4) safe_yaml.rb, (5)     safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7)     operatingsystem.rb, (8) operatingsystem.so, (9)     osfamily.rb, or (10) osfamily.so in puppet/confine.
    (CVE-2014-3248)

The remote host is affected by the vulnerability described in GLSA-201412-45 (Facter: Privilege escalation)

    Facter includes the current working directory in the search path.
  Impact :

    A local attacker may be able to gain escalated privileges.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-201412-15 (MCollective: Privilege escalation)

    Two vulnerabilities have been found in MCollective:
      An untrusted search path vulnerability exists in MCollective         (CVE-2014-3248)       MCollective does not properly validate server certificates         (CVE-2014-3251)   Impact :

    A local attacker can execute arbitrary a Trojan horse shared library,       potentially resulting in arbitrary code execution and privilege       escalation. Furthermore, a local attacker may be able to establish       unauthorized MCollective connections.
  Workaround :

    There is no known workaround at this time.

Update to 1.7.6 for bz#1107891 and CVE-2014-3248

See http://puppetlabs.com/security/cve/CVE-2014-3248 for more information upstream.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Puppet was updated to fix the following security issues :

  - Unsafe use of temporary files. (CVE-2013-4969)

  - Arbitrary code execution with required social     engineering. (CVE-2014-3248 / CVE-2014-3250)

According to its self-reported version number, the Puppet install on the remote host is affected by multiple vulnerabilities :

  - A privilege escalation vulnerability related to input     validation and paths exists in the bundled Ruby     environment. An attacker could trick a privileged user     into executing arbitrary code by convincing the user to     change directories and then run Puppet.
    (CVE-2014-3248)

  - An error exists related to the console role that could     allow unauthenticated users to obtain sensitive     information by hiding and unhiding nodes. Note that     this issue only affects Puppet Enterprise installs.
    (CVE-2014-3249)

  - An error exists related to configurations including     Apache 2.4 and the mod_ssl 'SSLCARevocationCheck' that     could allow an attacker to obtain sensitive     information. Note that this issue does not affect     Puppet Enterprise installs. (CVE-2014-3250)

ID	Name	Product	Family	Severity
100632	Ubuntu 14.04 LTS : Puppet vulnerabilities (USN-3308-1)	Nessus	Ubuntu Local Security Checks	high
81330	Amazon Linux AMI : puppet (ALAS-2015-484)	Nessus	Amazon Linux Local Security Checks	medium
80745	Oracle Solaris Third-Party Patch Update : puppet (multiple_vulnerabilities_in_puppet1)	Nessus	Solaris Local Security Checks	medium
80604	Oracle Solaris Third-Party Patch Update : facter (cve_2014_3248_untrusted_search)	Nessus	Solaris Local Security Checks	medium
80266	GLSA-201412-45 : Facter: Privilege escalation	Nessus	Gentoo Local Security Checks	medium
79968	GLSA-201412-15 : MCollective: Privilege escalation	Nessus	Gentoo Local Security Checks	medium
79840	Amazon Linux AMI : facter (ALAS-2014-456)	Nessus	Amazon Linux Local Security Checks	medium
79389	Fedora 20 : facter-1.7.6-1.fc20 (2014-12699)	Nessus	Fedora Local Security Checks	medium
76424	SuSE 11.3 Security Update : puppet (SAT Patch Number 9472)	Nessus	SuSE Local Security Checks	medium
76344	Puppet < 2.7.26 / 3.6.2 and Enterprise 2.8.x < 2.8.7 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2014-3248

high

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium