The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which might allow remote attackers to obtain sensitive information via a revoked certificate when a Puppet master runs with Apache 2.4.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck     directive, which might allow remote attackers to obtain sensitive information via a revoked certificate     when a Puppet master runs with Apache 2.4. (CVE-2014-3250)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Solaris system is missing necessary patches to address security updates :

  - Untrusted search path vulnerability in Puppet Enterprise     2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before     3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before     1.3.4, and Mcollective before 2.5.2, when running with     Ruby 1.9.1 or earlier, allows local users to gain     privileges via a Trojan horse file in the current     working directory, as demonstrated using (1)     rubygems/defaults/ operating_system.rb, (2) Win32API.rb,     (3) Win32API.so, (4) safe_yaml.rb, (5)     safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7)     operatingsystem.rb, (8) operatingsystem.so, (9)     osfamily.rb, or (10) osfamily.so in puppet/confine.
    (CVE-2014-3248)

Puppet was updated to fix the following security issues :

  - Unsafe use of temporary files. (CVE-2013-4969)

  - Arbitrary code execution with required social     engineering. (CVE-2014-3248 / CVE-2014-3250)

According to its self-reported version number, the Puppet install on the remote host is affected by multiple vulnerabilities :

  - A privilege escalation vulnerability related to input     validation and paths exists in the bundled Ruby     environment. An attacker could trick a privileged user     into executing arbitrary code by convincing the user to     change directories and then run Puppet.
    (CVE-2014-3248)

  - An error exists related to the console role that could     allow unauthenticated users to obtain sensitive     information by hiding and unhiding nodes. Note that     this issue only affects Puppet Enterprise installs.
    (CVE-2014-3249)

  - An error exists related to configurations including     Apache 2.4 and the mod_ssl 'SSLCARevocationCheck' that     could allow an attacker to obtain sensitive     information. Note that this issue does not affect     Puppet Enterprise installs. (CVE-2014-3250)

ID	Name	Product	Family	Severity
218356	Linux Distros Unpatched Vulnerability : CVE-2014-3250	Nessus	Misc.	medium
80745	Oracle Solaris Third-Party Patch Update : puppet (multiple_vulnerabilities_in_puppet1)	Nessus	Solaris Local Security Checks	medium
76424	SuSE 11.3 Security Update : puppet (SAT Patch Number 9472)	Nessus	SuSE Local Security Checks	medium
76344	Puppet < 2.7.26 / 3.6.2 and Enterprise 2.8.x < 2.8.7 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2014-3250

medium

Tenable Plugins

medium

medium

medium

medium