The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors related to (1) the change_user not dropping supplementary groups in certain conditions, (2) changes to the eguid without associated changes to the egid, or (3) the addition of the real gid to supplementary groups.

- Fixed bnc#747657: CVE-2012-1053, CVE-2012-1054: improper     privilege dropping and file handling flaws This was done     by updating to the new version in stable branch. The     stable branch receives only security fixes and this     update does not provide any new features.

  - Fixed bnc#755869 CVE-2012-1988: Filebucket arbitrary     code execution

  - Fixed bnc#755872 CVE-2012-1986: Arbitrary File Read

  - Fixed bnc#755870 CVE-2012-1987: Denial of Service

  - Fixed bnc#755871 CVE-2012-1989: Arbitrary File Write

Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a user login file with the k5login resource type, allows local users to gain privileges via a symlink attack on .k5login.

The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors related to (1) the change_user not dropping supplementary groups in certain conditions, (2) changes to the eguid without associated changes to the egid, or (3) the addition of the real gid to supplementary groups.

Please refer to the upstream release notes for details :

http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201203-03 (Puppet: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Puppet. Please review       the CVE identifiers referenced below for details.
  Impact :

    A local attacker could gain elevated privileges, or access and modify       arbitrary files.  Furthermore, a remote attacker may be able to spoof a       Puppet Master or write X.509 Certificate Signing Requests to arbitrary       locations.
  Workaround :

    There is no known workaround at this time.

This update of puppet fixes two vulnerabilities that could potentially be exploited by local attackers to escalate privileges due to improper privilege dropping and file handling issues (symlink flaws) in puppet.
(CVE-2012-1053 / CVE-2012-1054)

Two vulnerabilities were discovered in Puppet, a centralized configuration management tool.

  - CVE-2012-1053     Puppet runs execs with an unintended group privileges,     potentially leading to privilege escalation.

  - CVE-2012-1054     The k5login type writes to untrusted locations, enabling     local users to escalate their privileges if the k5login     type is used.

It was discovered that Puppet did not drop privileges when executing commands as different users. If an attacker had control of the execution manifests or the executed command, this could be used to execute code with elevated group permissions (typically root).
(CVE-2012-1053)

It was discovered that Puppet unsafely opened files when the k5login type is used to manage files. A local attacker could exploit this to overwrite arbitrary files and escalate privileges. (CVE-2012-1054).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
74671	openSUSE Security Update : puppet (openSUSE-SU-2012:0835-1)	Nessus	SuSE Local Security Checks	medium
69660	Amazon Linux AMI : puppet (ALAS-2012-53)	Nessus	Amazon Linux Local Security Checks	medium
58307	Fedora 16 : puppet-2.6.14-1.fc16 (2012-2415)	Nessus	Fedora Local Security Checks	medium
58306	Fedora 15 : puppet-2.6.14-1.fc15 (2012-2367)	Nessus	Fedora Local Security Checks	medium
58305	Fedora 17 : puppet-2.6.14-1.fc17 (2012-2325)	Nessus	Fedora Local Security Checks	medium
58213	GLSA-201203-03 : Puppet: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
58203	SuSE 11.1 Security Update : puppet (SAT Patch Number 5876)	Nessus	SuSE Local Security Checks	medium
58136	Debian DSA-2419-1 : puppet - several vulnerabilities	Nessus	Debian Local Security Checks	medium
58118	Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : puppet vulnerabilities (USN-1372-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2012-1053

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium