RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a "DNS hijack attack." NOTE: this vulnerability exists because to an incomplete fix for CVE-2015-3900.

According to its self-reported version number, the Puppet Enterprise application running on the remote host is version 3.7.x or 3.8.x prior to 3.8.1. It it, therefore, affected by the following vulnerabilities :

  - A flaw exists in RubyGems due to a failure to validate     hostnames when fetching gems or making API requests. A     remote attacker, using a crafted DNS SRV record, can     exploit this to redirect requests to arbitrary domains.
    (CVE-2015-3900)

  - A flaw exists in RubyGems due to a failure to sanitize     DNS responses, which allows a man-in-the-middle attacker     to install arbitrary applications. (CVE-2015-4020)

  - A flaw exists in Puppet Enterprise related to how     certificates are managed, under certain vulnerable     configurations, which allows a trusted certificate to be     used to perform full certificate management. An attacker     can exploit this flaw to revoke the certificates of     other nodes or to approve their certificate requests.
    (CVE-2015-4100)

Note that the default 'monolithic', 'split', and 'multimaster' installations of Puppet Enterprise are not affected by CVE-2015-4100.

RubyGems provides the ability of a domain to direct clients to a separate host that is used to fetch gems and make API calls against.
This mechanism is implemented via DNS, specificly a SRV record
_rubygems._tcp under the original requested domain. RubyGems did not validate the hostname returned in the SRV record before sending requests to it. (CVE-2015-3900)

As discussed upstream, CVE-2015-4020 is due to an incomplete fix for CVE-2015-3900 , which allowed redirection to an arbitrary gem server in any security domain.

ID	Name	Product	Family	Severity
84961	Puppet Enterprise 3.7.x < 3.8.1 / 3.8.x < 3.8.1 Multiple Vulnerabilities	Nessus	CGI abuses	medium
84250	Amazon Linux AMI : ruby22 (ALAS-2015-549)	Nessus	Amazon Linux Local Security Checks	medium
84249	Amazon Linux AMI : ruby21 (ALAS-2015-548)	Nessus	Amazon Linux Local Security Checks	medium
84248	Amazon Linux AMI : ruby20 (ALAS-2015-547)	Nessus	Amazon Linux Local Security Checks	medium

Detections

Analytics

CVE-2015-4020

medium

Tenable Plugins

medium

medium

medium

medium