telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log).

- Fixed bnc#747657: CVE-2012-1053, CVE-2012-1054: improper     privilege dropping and file handling flaws This was done     by updating to the new version in stable branch. The     stable branch receives only security fixes and this     update does not provide any new features.

  - Fixed bnc#755869 CVE-2012-1988: Filebucket arbitrary     code execution

  - Fixed bnc#755872 CVE-2012-1986: Arbitrary File Read

  - Fixed bnc#755870 CVE-2012-1987: Denial of Service

  - Fixed bnc#755871 CVE-2012-1989: Arbitrary File Write

puppet was prone to several security issues

This update fixes the following issues :

  - Filebucket arbitrary file read. (CVE-2011-1986)

  - Filebucket DoS. (CVE-2012-1987)

  - Filebucket arbitrary code execution. (CVE-2012-1988)

  - insecure handling of temporary files. (CVE-2012-1989)

The remote host is affected by the vulnerability described in GLSA-201208-02 (Puppet: Multiple vulnerabilities)

    Multiple vulnerabilities have been found in Puppet:
      Puppet uses predictable file names for temporary files         (CVE-2012-1906).
      REST requests for a file in a remote filebucket are not handled         properly by overriding filebucket storage locations (CVE-2012-1986).
      REST requests for a file in a remote filebucket are not handled         properly by reading streams or writing files on the Puppet master's         file system (CVE-2012-1987).
      File name paths are not properly sanitized from bucket requests         (CVE-2012-1988).
      The Telnet utility in Puppet does not handle temporary files securely         (CVE-2012-1989).
  Impact :

    A local attacker with access to agent SSL keys could possibly execute       arbitrary code with the privileges of the process, cause a Denial of       Service condition, or perform symlink attacks to overwrite or read       arbitrary files on the Puppet master.
  Workaround :

    There is no known workaround at this time.

It was discovered that Puppet used a predictable filename when downloading Mac OS X package files. A local attacker could exploit this to overwrite arbitrary files. (CVE-2012-1906)

It was discovered that Puppet incorrectly handled filebucket retrieval requests. A local attacker could exploit this to read arbitrary files.
(CVE-2012-1986)

It was discovered that Puppet incorrectly handled filebucket store requests. A local attacker could exploit this to perform a denial of service via resource exhaustion. (CVE-2012-1987)

It was discovered that Puppet incorrectly handled filebucket requests.
A local attacker could exploit this to execute arbitrary code via a crafted file path. (CVE-2012-1988)

It was discovered that Puppet used a predictable filename for the Telnet connection log file. A local attacker could exploit this to overwrite arbitrary files. This issue only affected Ubuntu 11.10.
(CVE-2012-1989).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities exist in puppet that can result in arbitrary code execution, arbitrary file read access, denial of service, and arbitrary file write access. Please review the details in each of the CVEs for additional information.

ID	Name	Product	Family	Severity
74671	openSUSE Security Update : puppet (openSUSE-SU-2012:0835-1)	Nessus	SuSE Local Security Checks	medium
74620	openSUSE Security Update : puppet (openSUSE-SU-2012:0608-1)	Nessus	SuSE Local Security Checks	medium
64217	SuSE 11.1 Security Update : puppet (SAT Patch Number 6115)	Nessus	SuSE Local Security Checks	high
61541	GLSA-201208-02 : Puppet: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
58680	Ubuntu 10.04 LTS / 11.04 / 11.10 : puppet vulnerabilities (USN-1419-1)	Nessus	Ubuntu Local Security Checks	medium
58670	FreeBSD : puppet -- Multiple Vulnerabilities (607d2108-a0e4-423a-bf78-846f2a8f01b0)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2012-1989

medium

Tenable Plugins

medium

medium

high

medium

medium

medium