Puppet Enterprise 3.x < 3.1.3 LibYAML Heap-Based Buffer Overflow

medium Nessus Plugin ID 73134

Language:

Synopsis

A web application on the remote host is affected by a buffer overflow vulnerability.

Description

According to its self-reported version number, the Puppet Enterprise 3.x install on the remote host is prior to 3.1.3. As a result, it is reportedly affected by an error related to the included LibYAML version, the 'yaml_parser_scan_tag_uri' function and YAML tag parsing that could allow a heap-based buffer overflow and potentially arbitrary code execution.

Solution

Upgrade to Puppet Enterprise 3.1.3 or later.

Plugin Details

Severity: Medium

ID: 73134

File Name: puppet_enterprise_313.nasl

Version: 1.5

Type: remote

Family: CGI abuses

Published: 3/21/2014

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.8

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:puppetlabs:puppet

Required KB Items: puppet/rest_port

Exploit Ease: No exploit is required

Patch Publication Date: 2/11/2014

Vulnerability Publication Date: 1/29/2014

Reference Information

CVE: CVE-2013-6393

BID: 65258

Detections

Analytics