Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof a Puppet master via a man-in-the-middle (MITM) attack against an agent that uses an alternate DNS name for the master, aka "AltNames Vulnerability."

Puppet's certificate authority issued Puppet agent certificates capable of impersonating the Puppet master. Compromised or rogue puppet agents could therefore use their certificates for MITM attacks (CVE-2011-3872). 

Note: If you've set the 'certdnsnames' option in your master's puppet.conf file merely installing the updated packages is not sufficient to fix this problem. You need to either pick a new DNS name for the master and reconfigure all agents to use it or re-new certificates on all agents.

Please refer to the documentation in /usr/share/doc/packages/puppet/puppetlabs-cve20113872-0.0.5 for detailed instructions and scripts. 

Puppetlabs' site also provides more information:
http://puppetlabs.com/security/cve/cve-2011-3872/faq/ http://puppetlabs.com/blog/important-security-announcement-altnames-vu lnerability/

--

Directory traversal vulnerability in puppet allowed unauthenticated remote attackers to upload x.509 certificate signing requests to arbitrary locations (CVE-2011-3848)

Puppet was prone to several symlink attacks (CVE-2011-3870, CVE-2011-3869, CVE-2011-3871)

The remote host is affected by the vulnerability described in GLSA-201203-03 (Puppet: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Puppet. Please review       the CVE identifiers referenced below for details.
  Impact :

    A local attacker could gain elevated privileges, or access and modify       arbitrary files.  Furthermore, a remote attacker may be able to spoof a       Puppet Master or write X.509 Certificate Signing Requests to arbitrary       locations.
  Workaround :

    There is no known workaround at this time.

The following security issues have been fixed :

  - Puppet's certificate authority issued Puppet agent     certificates capable of impersonating the Puppet master.
    Compromised or rogue puppet agents could therefore use     their certificates for MITM attacks. (CVE-2011-3872)

    Note: If you've set the 'certdnsnames' option in your     master's puppet.conf file merely installing the updated     packages is not sufficient to fix this problem. You need     to either pick a new DNS name for the master and     reconfigure all agents to use it or re-new certificates     on all agents.

    Please refer to the documentation in     /usr/share/doc/packages/puppet/puppetlabs-cve20113872-0.
    0.5 for detailed instructions and scripts.

    Puppetlabs' site also provides more information:
    http://puppetlabs.com/security/cve/cve-2011-3872/faq/     http://puppetlabs.com/blog/important-security-announceme     nt-altnames-vulnerability/

  - Directory traversal vulnerability in puppet allowed     unauthenticated remote attackers to upload x.509     certificate signing requests to arbitrary locations.
    (CVE-2011-3848)

  - Puppet was prone to several symlink attacks     (CVE-2011-3870 / CVE-2011-3869 / CVE-2011-3871)

It was discovered that Puppet, a centralized configuration management solution, misgenerated certificates if the 'certdnsnames' option was used. This could lead to man in the middle attacks. More details are available on the Puppet website.

It was discovered that Puppet incorrectly handled the non-default 'certdnsnames' option when generating certificates. If this setting was added to puppet.conf, the puppet master's DNS alt names were added to the X.509 Subject Alternative Name field of all certificates, not just the puppet master's certificate. An attacker that has an incorrect agent certificate in his possession can use it to impersonate the puppet master in a man-in-the-middle attack.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
75999	openSUSE Security Update : puppet (openSUSE-SU-2011:1288-1)	Nessus	SuSE Local Security Checks	Local	medium
75715	openSUSE Security Update : puppet (openSUSE-SU-2011:1288-1)	Nessus	SuSE Local Security Checks	Local	medium
58213	GLSA-201203-03 : Puppet: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	medium
57129	SuSE 11.1 Security Update : puppet (SAT Patch Number 5421)	Nessus	SuSE Local Security Checks	Local	medium
56923	Debian DSA-2352-1 : puppet - programming error	Nessus	Debian Local Security Checks	Local	low
56630	Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : puppet vulnerability (USN-1238-1)	Nessus	Ubuntu Local Security Checks	Local	low

Detections

Analytics

CVE-2011-3872

low

Tenable Plugins

medium

medium

medium

medium

low

low