Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote authenticated users to read arbitrary files on the puppet master server by leveraging an arbitrary user's certificate and private key in a GET request.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1542 advisory.

  - puppet: Filebucket arbitrary file read (CVE-2012-1986)

  - puppet: Filebucket denial of service (CVE-2012-1987)

  - puppet: Filebucket arbitrary code execution (CVE-2012-1988)

  - rubygem-mail: directory traversal (CVE-2012-2139)

  - rubygem-mail: arbitrary command execution when using exim or sendmail from commandline (CVE-2012-2140)

  - rubygem-actionpack: Unsafe query generation (CVE-2012-2660)

  - rubygem-activerecord: SQL injection when processing nested query paramaters (CVE-2012-2661)

  - rubygem-actionpack: Unsafe query generation (a different flaw than CVE-2012-2660) (CVE-2012-2694)

  - rubygem-activerecord: SQL injection when processing nested query paramaters (a different flaw than     CVE-2012-2661) (CVE-2012-2695)

  - rubygem-actionpack: DoS vulnerability in authenticate_or_request_with_http_digest (CVE-2012-3424)

  - rubygem-actionpack: potential XSS vulnerability in select_tag prompt (CVE-2012-3463)

  - rubygem-actionpack: potential XSS vulnerability (CVE-2012-3464)

  - rubygem-actionpack: XSS Vulnerability in strip_tags (CVE-2012-3465)

  - puppet: authenticated clients allowed to read arbitrary files from the puppet master (CVE-2012-3864)

  - puppet: authenticated clients allowed to delete arbitrary files on the puppet master (CVE-2012-3865)

  - puppet: insufficient validation of agent names in CN of SSL certificate requests (CVE-2012-3867)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

puppet was updated to fix various security issues: CVEs fixed :

  - bnc#770828 - CVE-2012-3864: puppet: authenticated     clients can read arbitrary files via a flaw in puppet     master

  - bnc#770829 - CVE-2012-3865: puppet: arbitrary file     delete / Denial of Service on Puppet Master by     authenticated clients

  - bnc#770827 - CVE-2012-3866: puppet: last_run_report.yaml     left world-readable

  - bnc#770833 - CVE-2012-3867: puppet: insufficient input     validation for agent certificate names

  - using the new stable version, 2.6.17, which only     receives security fixes.

  - Removed runlevel 4.

Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.

Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote authenticated users to read arbitrary files on the puppet master server by leveraging an arbitrary user's certificate and private key in a GET request.

lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.

lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file.

The following bugs have been fixed in puppet :

  - puppet: authenticated clients can read arbitrary files     via a flaw in puppet master. (bnc#770828, CVE-2012-3864)

  - puppet: arbitrary file delete / Denial of Service on     Puppet Master by authenticated clients. (bnc#770829,     CVE-2012-3865)

  - puppet: insufficient input validation for agent     certificate names. (bnc#770833, CVE-2012-3867)

puppet -- multiple vulnerabilities

Arbitrary file read on the puppet master from authenticated clients (high). It is possible to construct an HTTP get request from an authenticated client with a valid certificate that will return the contents of an arbitrary file on the Puppet master that the master has read-access to.

Arbitrary file delete/D.O.S on Puppet Master from authenticated clients (high). Given a Puppet master with the 'Delete' directive allowed in auth.conf for an authenticated host, an attacker on that host can send a specially crafted Delete request that can cause an arbitrary file deletion on the Puppet master, potentially causing a denial of service attack. Note that this vulnerability does *not* exist in Puppet as configured by default.

Insufficient input validation for agent hostnames (low). An attacker could trick the administrator into signing an attacker's certificate rather than the intended one by constructing specially crafted certificate requests containing specific ANSI control sequences. It is possible to use the sequences to rewrite the order of text displayed to an administrator such that display of an invalid certificate and valid certificate are transposed. If the administrator signs the attacker's certificate, the attacker can then man-in-the-middle the agent.

This is an upstream security release. It addresses a number of issues found in puppet-2.6.x. The Red Hat security team has rated this update as having low security impact.

Refer to the upstream release notes and bugzilla entries for further details.

http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.17

NetworkManager compatibility should be improved in this release, thanks to Orion Poplawski (any bugs in implementing Orion's suggested dispatcher script are my own).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This is an upstream security release. It addresses a number of issues found in puppet-2.7.x. The Red Hat security team has rated this update as having low security impact.

Refer to the upstream release notes and bugzilla entries for further details.

http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.7.18

NetworkManager compatibility should be improved in this release, thanks to Orion Poplawski (any bugs in implementing Orion's suggested dispatcher script are my own).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several security vulnerabilities have been found in Puppet, a centralized configuration management :

  - CVE-2012-3864     Authenticated clients could read arbitrary files on the     puppet master.

  - CVE-2012-3865     Authenticated clients could delete arbitrary files on     the puppet master.

  - CVE-2012-3866     The report of the most recent Puppet run was stored with     world readable permissions, resulting in information     disclosure.

  - CVE-2012-3867     Agent hostnames were insufficiently validated.

It was discovered that Puppet incorrectly handled certain HTTP GET requests. An attacker could use this flaw with a valid client certificate to retrieve arbitrary files from the Puppet master.
(CVE-2012-3864)

It was discovered that Puppet incorrectly handled Delete requests. If a Puppet master were reconfigured to allow the 'Delete' method, an attacker on an authenticated host could use this flaw to delete arbitrary files from the Puppet server, leading to a denial of service. (CVE-2012-3865)

It was discovered that Puppet incorrectly set file permissions on the last_run_report.yaml file. An attacker could use this flaw to access sensitive information. This issue only affected Ubuntu 11.10 and Ubuntu 12.04 LTS. (CVE-2012-3866)

It was discovered that Puppet incorrectly handled agent certificate names. An attacker could use this flaw to create a specially crafted certificate and trick an administrator into signing a certificate that can then be used to man-in-the-middle agent nodes. (CVE-2012-3867).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

puppet -- multiple vulnerabilities

Arbitrary file read on the puppet master from authenticated clients (high). It is possible to construct an HTTP get request from an authenticated client with a valid certificate that will return the contents of an arbitrary file on the Puppet master that the master has read-access to.

Arbitrary file delete/D.O.S on Puppet Master from authenticated clients (high). Given a Puppet master with the 'Delete' directive allowed in auth.conf for an authenticated host, an attacker on that host can send a specially crafted Delete request that can cause an arbitrary file deletion on the Puppet master, potentially causing a denial of service attack. Note that this vulnerability does *not* exist in Puppet as configured by default.

The last_run_report.yaml is world readable (medium). The most recent Puppet run report is stored on the Puppet master with world-readable permissions. The report file contains the context diffs of any changes to configuration on an agent, which may contain sensitive information that an attacker can then access. The last run report is overwritten with every Puppet run.

Arbitrary file read on the Puppet master by an agent (medium). This vulnerability is dependent upon vulnerability 'last_run_report.yml is world readable' above. By creating a hard link of a Puppet-managed file to an arbitrary file that the Puppet master can read, an attacker forces the contents to be written to the puppet run summary. The context diff is stored in last_run_report.yaml, which can then be accessed by the attacker.

Insufficient input validation for agent hostnames (low). An attacker could trick the administrator into signing an attacker's certificate rather than the intended one by constructing specially crafted certificate requests containing specific ANSI control sequences. It is possible to use the sequences to rewrite the order of text displayed to an administrator such that display of an invalid certificate and valid certificate are transposed. If the administrator signs the attacker's certificate, the attacker can then man-in-the-middle the agent.

Agents with certnames of IP addresses can be impersonated (low). If an authenticated host with a certname of an IP address changes IP addresses, and a second host assumes the first host's former IP address, the second host will be treated by the puppet master as the first one, giving the second host access to the first host's catalog.
Note: This will not be fixed in Puppet versions prior to the forthcoming 3.x. Instead, with this announcement IP-based authentication in Puppet < 3.x is deprecated.

ID	Name	Product	Family	Severity
193969	RHEL 6 : CloudForms Commons 1.1 (RHSA-2012:1542)	Nessus	Red Hat Local Security Checks	high
74684	openSUSE Security Update : puppet (openSUSE-SU-2012:0891-1)	Nessus	SuSE Local Security Checks	medium
69625	Amazon Linux AMI : puppet (ALAS-2012-135)	Nessus	Amazon Linux Local Security Checks	medium
64218	SuSE 11.1 Security Update : puppet (SAT Patch Number 6561)	Nessus	SuSE Local Security Checks	medium
63368	FreeBSD : puppet -- multiple vulnerabilities (101f0aae-52d1-11e2-87fe-f4ce46b9ace8)	Nessus	FreeBSD Local Security Checks	medium
60146	Fedora 16 : puppet-2.6.17-2.fc16 (2012-10897)	Nessus	Fedora Local Security Checks	medium
60144	Fedora 17 : puppet-2.7.18-1.fc17 (2012-10891)	Nessus	Fedora Local Security Checks	medium
60002	Debian DSA-2511-1 : puppet - several vulnerabilities	Nessus	Debian Local Security Checks	medium
59965	Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : puppet vulnerabilities (USN-1506-1)	Nessus	Ubuntu Local Security Checks	medium
59945	FreeBSD : puppet -- multiple vulnerabilities (3a6960ef-c8a8-11e1-9924-001fd0af1a4c)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2012-3864

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium