Puppet: Multiple vulnerabilities — GLSA 201208-02

Multiple vulnerabilities have been found in Puppet, the worst of which could lead to execution of arbitrary code.

Affected packages

Background

Puppet is a system configuration management tool written in Ruby.

Description

Multiple vulnerabilities have been found in Puppet:

• Puppet uses predictable file names for temporary files (CVE-2012-1906).
• REST requests for a file in a remote filebucket are not handled properly by overriding filebucket storage locations (CVE-2012-1986).
• REST requests for a file in a remote filebucket are not handled properly by reading streams or writing files on the Puppet master's file system (CVE-2012-1987).
• File name paths are not properly sanitized from bucket requests (CVE-2012-1988).
• The Telnet utility in Puppet does not handle temporary files securely (CVE-2012-1989).

Impact

A local attacker with access to agent SSL keys could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, or perform symlink attacks to overwrite or read arbitrary files on the Puppet master.

Workaround

There is no known workaround at this time.

Resolution

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=app-admin/puppet-2.7.13"
 

References

• CVE-2012-1906
• CVE-2012-1986
• CVE-2012-1987
• CVE-2012-1988
• CVE-2012-1989

Release date
August 14, 2012

Latest revision
August 14, 2012: 1

Severity
high

Exploitable
local

Bugzilla entries

• 410857