Puppet's certificate authority issued Puppet agent certificates capable of impersonating the Puppet master. Compromised or rogue puppet agents could therefore use their certificates for MITM attacks (CVE-2011-3872). 

Note: If you've set the 'certdnsnames' option in your master's puppet.conf file merely installing the updated packages is not sufficient to fix this problem. You need to either pick a new DNS name for the master and reconfigure all agents to use it or re-new certificates on all agents.

Please refer to the documentation in /usr/share/doc/packages/puppet/puppetlabs-cve20113872-0.0.5 for detailed instructions and scripts. 

Puppetlabs' site also provides more information:
http://puppetlabs.com/security/cve/cve-2011-3872/faq/ http://puppetlabs.com/blog/important-security-announcement-altnames-vu lnerability/

--

Directory traversal vulnerability in puppet allowed unauthenticated remote attackers to upload x.509 certificate signing requests to arbitrary locations (CVE-2011-3848)

Puppet was prone to several symlink attacks (CVE-2011-3870, CVE-2011-3869, CVE-2011-3871)

The remote host is affected by the vulnerability described in GLSA-201203-03 (Puppet: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Puppet. Please review       the CVE identifiers referenced below for details.
  Impact :

    A local attacker could gain elevated privileges, or access and modify       arbitrary files.  Furthermore, a remote attacker may be able to spoof a       Puppet Master or write X.509 Certificate Signing Requests to arbitrary       locations.
  Workaround :

    There is no known workaround at this time.

It was discovered that Puppet incorrectly handled the non-default 'certdnsnames' option when generating certificates. If this setting was added to puppet.conf, the puppet master's DNS alt names were added to the X.509 Subject Alternative Name field of all certificates, not just the puppet master's certificate. An attacker that has an incorrect agent certificate in his possession can use it to impersonate the puppet master in a man-in-the-middle attack.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Puppet, a centralized configuration management solution, misgenerated certificates if the 'certdnsnames' option was used. This could lead to man in the middle attacks. More details are available on the Puppet website.

The following security issues have been fixed :

  - Puppet's certificate authority issued Puppet agent     certificates capable of impersonating the Puppet master.
    Compromised or rogue puppet agents could therefore use     their certificates for MITM attacks. (CVE-2011-3872)

    Note: If you've set the 'certdnsnames' option in your     master's puppet.conf file merely installing the updated     packages is not sufficient to fix this problem. You need     to either pick a new DNS name for the master and     reconfigure all agents to use it or re-new certificates     on all agents.

    Please refer to the documentation in     /usr/share/doc/packages/puppet/puppetlabs-cve20113872-0.
    0.5 for detailed instructions and scripts.

    Puppetlabs' site also provides more information:
    http://puppetlabs.com/security/cve/cve-2011-3872/faq/     http://puppetlabs.com/blog/important-security-announceme     nt-altnames-vulnerability/

  - Directory traversal vulnerability in puppet allowed     unauthenticated remote attackers to upload x.509     certificate signing requests to arbitrary locations.
    (CVE-2011-3848)

  - Puppet was prone to several symlink attacks     (CVE-2011-3870 / CVE-2011-3869 / CVE-2011-3871)

ID	Name	Product	Family	Published	Updated	Severity
75999	openSUSE Security Update : puppet (openSUSE-SU-2011:1288-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	medium
75715	openSUSE Security Update : puppet (openSUSE-SU-2011:1288-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/14/2021	medium
58213	GLSA-201203-03 : Puppet: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	3/6/2012	1/6/2021	medium
56630	Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : puppet vulnerability (USN-1238-1)	Nessus	Ubuntu Local Security Checks	10/25/2011	9/19/2019	low
56923	Debian DSA-2352-1 : puppet - programming error	Nessus	Debian Local Security Checks	11/23/2011	1/11/2021	low
57129	SuSE 11.1 Security Update : puppet (SAT Patch Number 5421)	Nessus	SuSE Local Security Checks	12/13/2011	1/19/2021	medium

Detections

Analytics

Plugins Search

medium

medium

medium

low

low

medium