Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.

The remote host is affected by the vulnerability described in GLSA-201208-02 (Puppet: Multiple vulnerabilities)

    Multiple vulnerabilities have been found in Puppet:
      Puppet uses predictable file names for temporary files         (CVE-2012-1906).
      REST requests for a file in a remote filebucket are not handled         properly by overriding filebucket storage locations (CVE-2012-1986).
      REST requests for a file in a remote filebucket are not handled         properly by reading streams or writing files on the Puppet master's         file system (CVE-2012-1987).
      File name paths are not properly sanitized from bucket requests         (CVE-2012-1988).
      The Telnet utility in Puppet does not handle temporary files securely         (CVE-2012-1989).
  Impact :

    A local attacker with access to agent SSL keys could possibly execute       arbitrary code with the privileges of the process, cause a Denial of       Service condition, or perform symlink attacks to overwrite or read       arbitrary files on the Puppet master.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities have been discovered in Puppet, a centralized configuration management system. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2012-1906     Puppet is using predictable temporary file names when     downloading Mac OS X package files. This allows a local     attacker to either overwrite arbitrary files on the     system or to install an arbitrary package.

  - CVE-2012-1986     When handling requests for a file from a remote     filebucket, Puppet can be tricked into overwriting its     defined location for filebucket storage. This allows an     authorized attacker with access to the Puppet master to     read arbitrary files.

  - CVE-2012-1987     Puppet is incorrectly handling filebucket store     requests. This allows an attacker to perform denial of     service attacks against Puppet by resource exhaustion.

  - CVE-2012-1988     Puppet is incorrectly handling filebucket requests. This     allows an attacker with access to the certificate on the     agent and an unprivileged account on Puppet master to     execute arbitrary code via crafted file path names and     making a filebucket request.

It was discovered that Puppet used a predictable filename when downloading Mac OS X package files. A local attacker could exploit this to overwrite arbitrary files. (CVE-2012-1906)

It was discovered that Puppet incorrectly handled filebucket retrieval requests. A local attacker could exploit this to read arbitrary files.
(CVE-2012-1986)

It was discovered that Puppet incorrectly handled filebucket store requests. A local attacker could exploit this to perform a denial of service via resource exhaustion. (CVE-2012-1987)

It was discovered that Puppet incorrectly handled filebucket requests.
A local attacker could exploit this to execute arbitrary code via a crafted file path. (CVE-2012-1988)

It was discovered that Puppet used a predictable filename for the Telnet connection log file. A local attacker could exploit this to overwrite arbitrary files. This issue only affected Ubuntu 11.10.
(CVE-2012-1989).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities exist in puppet that can result in arbitrary code execution, arbitrary file read access, denial of service, and arbitrary file write access. Please review the details in each of the CVEs for additional information.

ID	Name	Product	Family	Severity
61541	GLSA-201208-02 : Puppet: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
58753	Debian DSA-2451-1 : puppet - several vulnerabilities	Nessus	Debian Local Security Checks	medium
58680	Ubuntu 10.04 LTS / 11.04 / 11.10 : puppet vulnerabilities (USN-1419-1)	Nessus	Ubuntu Local Security Checks	medium
58670	FreeBSD : puppet -- Multiple Vulnerabilities (607d2108-a0e4-423a-bf78-846f2a8f01b0)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2012-1906

medium

Tenable Plugins

medium

medium

medium

medium