Debian DSA-2314-1 : puppet - multiple vulnerabilities

medium Nessus Plugin ID 56381

Language:

Synopsis

The remote Debian host is missing a security-related update.

Description

Multiple security issues have been discovered in Puppet, a centralized configuration management system. The Common Vulnerabilities and Exposures project identifies the following problems :

- CVE-2011-3848 Kristian Erik Hermansen reported that an unauthenticated directory traversal could drop any valid X.509 Certificate Signing Request at any location on disk, with the privileges of the Puppet Master application.

- CVE-2011-3870 Ricky Zhou discovered a potential local privilege escalation in the ssh_authorized_keys resource and theoretically in the Solaris and AIX providers, where file ownership was given away before it was written, leading to a possibility for a user to overwrite arbitrary files as root, if their authorized_keys file was managed.

- CVE-2011-3869 A predictable file name in the k5login type leads to the possibility of symlink attacks which would allow the owner of the home directory to symlink to anything on the system, and have it replaced with the'correct' content of the file, which can lead to a privilege escalation on puppet runs.

- CVE-2011-3871 A potential local privilege escalation was found in the
--edit mode of 'puppet resource' due to a persistent, predictable file name, which can result in editing an arbitrary target file, and thus be be tricked into running that arbitrary file as the invoking user. This command is most commonly run as root, this leads to a potential privilege escalation.

Additionally, this update hardens the indirector file backed terminus base class against injection attacks based on trusted path names.

Solution

Upgrade the puppet packages.

For the oldstable distribution (lenny), this problem will be fixed soon.

For the stable distribution (squeeze), this problem has been fixed in version 2.6.2-5+squeeze1.

Plugin Details

Severity: Medium

ID: 56381

File Name: debian_DSA-2314.nasl

Version: 1.12

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 10/4/2011

Updated: 1/11/2021

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Medium

Base Score: 6.3

Temporal Score: 4.7

Vector: CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:6.0, p-cpe:/a:debian:debian_linux:puppet

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 10/3/2011

Reference Information

CVE: CVE-2011-3848, CVE-2011-3869, CVE-2011-3870, CVE-2011-3871

BID: 49860, 49909

DSA: 2314

Detections

Analytics