Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full pathname contains shell metacharacters, then performing a filebucket request.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1542 advisory.

  - puppet: Filebucket arbitrary file read (CVE-2012-1986)

  - puppet: Filebucket denial of service (CVE-2012-1987)

  - puppet: Filebucket arbitrary code execution (CVE-2012-1988)

  - rubygem-mail: directory traversal (CVE-2012-2139)

  - rubygem-mail: arbitrary command execution when using exim or sendmail from commandline (CVE-2012-2140)

  - rubygem-actionpack: Unsafe query generation (CVE-2012-2660)

  - rubygem-activerecord: SQL injection when processing nested query paramaters (CVE-2012-2661)

  - rubygem-actionpack: Unsafe query generation (a different flaw than CVE-2012-2660) (CVE-2012-2694)

  - rubygem-activerecord: SQL injection when processing nested query paramaters (a different flaw than     CVE-2012-2661) (CVE-2012-2695)

  - rubygem-actionpack: DoS vulnerability in authenticate_or_request_with_http_digest (CVE-2012-3424)

  - rubygem-actionpack: potential XSS vulnerability in select_tag prompt (CVE-2012-3463)

  - rubygem-actionpack: potential XSS vulnerability (CVE-2012-3464)

  - rubygem-actionpack: XSS Vulnerability in strip_tags (CVE-2012-3465)

  - puppet: authenticated clients allowed to read arbitrary files from the puppet master (CVE-2012-3864)

  - puppet: authenticated clients allowed to delete arbitrary files on the puppet master (CVE-2012-3865)

  - puppet: insufficient validation of agent names in CN of SSL certificate requests (CVE-2012-3867)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- Fixed bnc#747657: CVE-2012-1053, CVE-2012-1054: improper     privilege dropping and file handling flaws This was done     by updating to the new version in stable branch. The     stable branch receives only security fixes and this     update does not provide any new features.

  - Fixed bnc#755869 CVE-2012-1988: Filebucket arbitrary     code execution

  - Fixed bnc#755872 CVE-2012-1986: Arbitrary File Read

  - Fixed bnc#755870 CVE-2012-1987: Denial of Service

  - Fixed bnc#755871 CVE-2012-1989: Arbitrary File Write

puppet was prone to several security issues

This update fixes the following issues :

  - Filebucket arbitrary file read. (CVE-2011-1986)

  - Filebucket DoS. (CVE-2012-1987)

  - Filebucket arbitrary code execution. (CVE-2012-1988)

  - insecure handling of temporary files. (CVE-2012-1989)

The remote host is affected by the vulnerability described in GLSA-201208-02 (Puppet: Multiple vulnerabilities)

    Multiple vulnerabilities have been found in Puppet:
      Puppet uses predictable file names for temporary files         (CVE-2012-1906).
      REST requests for a file in a remote filebucket are not handled         properly by overriding filebucket storage locations (CVE-2012-1986).
      REST requests for a file in a remote filebucket are not handled         properly by reading streams or writing files on the Puppet master's         file system (CVE-2012-1987).
      File name paths are not properly sanitized from bucket requests         (CVE-2012-1988).
      The Telnet utility in Puppet does not handle temporary files securely         (CVE-2012-1989).
  Impact :

    A local attacker with access to agent SSL keys could possibly execute       arbitrary code with the privileges of the process, cause a Denial of       Service condition, or perform symlink attacks to overwrite or read       arbitrary files on the Puppet master.
  Workaround :

    There is no known workaround at this time.

With Fedora 17 using ruby-1.9.3, an update to puppet-2.7, which has improved support for ruby-1.9, is required. Note that ruby-1.9 is not fully supported in the puppet-2.7 series. Where possible, patches from the next upstream release branch will be backported to improve ruby-1.9 compatibility.

Also note that there will likely be issues when connecting to a puppet-2.6 master. This is unavoidable for the moment. Normally all Fedora and EPEL branches are kept in sync to avoid this problem. At this time, a decision to move all branches to 2.7 has not been made.

This update obsoletes puppet-2.6.16, which fixed several security issues recently found in puppet related to filebucket functionality.
For full details, refer to the upstream release notes :

http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.7.13

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes several security issues recently found in puppet related to filebucket functionality. For full details, refer to the upstream release notes :

http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in Puppet, a centralized configuration management system. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2012-1906     Puppet is using predictable temporary file names when     downloading Mac OS X package files. This allows a local     attacker to either overwrite arbitrary files on the     system or to install an arbitrary package.

  - CVE-2012-1986     When handling requests for a file from a remote     filebucket, Puppet can be tricked into overwriting its     defined location for filebucket storage. This allows an     authorized attacker with access to the Puppet master to     read arbitrary files.

  - CVE-2012-1987     Puppet is incorrectly handling filebucket store     requests. This allows an attacker to perform denial of     service attacks against Puppet by resource exhaustion.

  - CVE-2012-1988     Puppet is incorrectly handling filebucket requests. This     allows an attacker with access to the certificate on the     agent and an unprivileged account on Puppet master to     execute arbitrary code via crafted file path names and     making a filebucket request.

It was discovered that Puppet used a predictable filename when downloading Mac OS X package files. A local attacker could exploit this to overwrite arbitrary files. (CVE-2012-1906)

It was discovered that Puppet incorrectly handled filebucket retrieval requests. A local attacker could exploit this to read arbitrary files.
(CVE-2012-1986)

It was discovered that Puppet incorrectly handled filebucket store requests. A local attacker could exploit this to perform a denial of service via resource exhaustion. (CVE-2012-1987)

It was discovered that Puppet incorrectly handled filebucket requests.
A local attacker could exploit this to execute arbitrary code via a crafted file path. (CVE-2012-1988)

It was discovered that Puppet used a predictable filename for the Telnet connection log file. A local attacker could exploit this to overwrite arbitrary files. This issue only affected Ubuntu 11.10.
(CVE-2012-1989).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities exist in puppet that can result in arbitrary code execution, arbitrary file read access, denial of service, and arbitrary file write access. Please review the details in each of the CVEs for additional information.

ID	Name	Product	Family	Severity
193969	RHEL 6 : CloudForms Commons 1.1 (RHSA-2012:1542)	Nessus	Red Hat Local Security Checks	high
74671	openSUSE Security Update : puppet (openSUSE-SU-2012:0835-1)	Nessus	SuSE Local Security Checks	medium
74620	openSUSE Security Update : puppet (openSUSE-SU-2012:0608-1)	Nessus	SuSE Local Security Checks	medium
64217	SuSE 11.1 Security Update : puppet (SAT Patch Number 6115)	Nessus	SuSE Local Security Checks	high
61541	GLSA-201208-02 : Puppet: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
59000	Fedora 17 : puppet-2.7.13-1.fc17 (2012-6674)	Nessus	Fedora Local Security Checks	medium
58911	Fedora 15 : puppet-2.6.16-1.fc15 (2012-6055)	Nessus	Fedora Local Security Checks	medium
58909	Fedora 16 : puppet-2.6.16-1.fc16 (2012-5999)	Nessus	Fedora Local Security Checks	medium
58753	Debian DSA-2451-1 : puppet - several vulnerabilities	Nessus	Debian Local Security Checks	medium
58680	Ubuntu 10.04 LTS / 11.04 / 11.10 : puppet vulnerabilities (USN-1419-1)	Nessus	Ubuntu Local Security Checks	medium
58670	FreeBSD : puppet -- Multiple Vulnerabilities (607d2108-a0e4-423a-bf78-846f2a8f01b0)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2012-1988

medium

Tenable Plugins

high

medium

medium

high

medium

medium

medium

medium

medium

medium

medium