The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which might allow remote attackers to obtain sensitive information via a revoked certificate when a Puppet master runs with Apache 2.4.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - puppet: incorrect URL decoding (CVE-2016-2785)

  - The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck     directive, which might allow remote attackers to obtain sensitive information via a revoked certificate     when a Puppet master runs with Apache 2.4. (CVE-2014-3250)

  - The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC     padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-     oracle attack, aka the POODLE issue. (CVE-2014-3566)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Solaris system is missing necessary patches to address security updates :

  - Untrusted search path vulnerability in Puppet Enterprise     2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before     3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before     1.3.4, and Mcollective before 2.5.2, when running with     Ruby 1.9.1 or earlier, allows local users to gain     privileges via a Trojan horse file in the current     working directory, as demonstrated using (1)     rubygems/defaults/ operating_system.rb, (2) Win32API.rb,     (3) Win32API.so, (4) safe_yaml.rb, (5)     safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7)     operatingsystem.rb, (8) operatingsystem.so, (9)     osfamily.rb, or (10) osfamily.so in puppet/confine.
    (CVE-2014-3248)

Puppet was updated to fix the following security issues :

  - Unsafe use of temporary files. (CVE-2013-4969)

  - Arbitrary code execution with required social     engineering. (CVE-2014-3248 / CVE-2014-3250)

According to its self-reported version number, the Puppet install on the remote host is affected by multiple vulnerabilities :

  - A privilege escalation vulnerability related to input     validation and paths exists in the bundled Ruby     environment. An attacker could trick a privileged user     into executing arbitrary code by convincing the user to     change directories and then run Puppet.
    (CVE-2014-3248)

  - An error exists related to the console role that could     allow unauthenticated users to obtain sensitive     information by hiding and unhiding nodes. Note that     this issue only affects Puppet Enterprise installs.
    (CVE-2014-3249)

  - An error exists related to configurations including     Apache 2.4 and the mod_ssl 'SSLCARevocationCheck' that     could allow an attacker to obtain sensitive     information. Note that this issue does not affect     Puppet Enterprise installs. (CVE-2014-3250)

ID	Name	Product	Family	Severity
199619	RHEL 6 : puppet (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
80745	Oracle Solaris Third-Party Patch Update : puppet (multiple_vulnerabilities_in_puppet1)	Nessus	Solaris Local Security Checks	medium
76424	SuSE 11.3 Security Update : puppet (SAT Patch Number 9472)	Nessus	SuSE Local Security Checks	medium
76344	Puppet < 2.7.26 / 3.6.2 and Enterprise 2.8.x < 2.8.7 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2014-3250

medium

Tenable Plugins

critical

medium

medium

medium