Red Hat OpenStack Essex and Folsom creates the /var/log/puppet directory with world-readable permissions, which allows local users to obtain sensitive information such as Puppet log files.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0710 advisory.

    Puppet allows provisioning, patching, and configuration of clients to be     managed and automated.

    A flaw was found in how Puppet handled certain HTTP PUT requests. An     attacker with valid authentication credentials, and authorized to save to     the authenticated client's own report, could construct a malicious request     that could possibly cause the Puppet master to execute arbitrary code.
    (CVE-2013-2274)

    A flaw was found in how Puppet handled the template and inline_template     functions during catalog compilation. If an authenticated attacker were to     requests its catalog from the Puppet master, it could possibly result in     arbitrary code execution when the catalog is compiled. (CVE-2013-1640)

    A flaw was found in how Puppet handled certain HTTP GET requests. An     attacker with valid authentication credentials could construct a request to     retrieve catalogs from the Puppet master that they are not authorized to     access. (CVE-2013-1652)

    It was found that the default /etc/puppet/auth.conf configuration file     allowed an authenticated node to submit a report for any other node, which     could breach compliance requirements. (CVE-2013-2275)

    It was found that the /var/log/puppet directory was created world-readable.
    This could allow local users to obtain sensitive information from the     Puppet log files. (CVE-2012-6120)

    It was found that Puppet allowed the use of the SSLv2 protocol. A Puppet     agent could use this to negotiate the use of the weak SSLv2 protocol for     its connection to a Puppet master. (CVE-2013-1654)

    Red Hat would like to thank Puppet Labs for reporting CVE-2013-1640,     CVE-2013-1652, CVE-2013-1654, CVE-2013-2274, and CVE-2013-2275.

    Note: In most default configurations these issues are not directly     exploitable unless the attacker has access to the underlying OpenStack     infrastructure (e.g. shell access to a Nova compute node).

    Users of Red Hat OpenStack Folsom are advised to upgrade to these updated     packages, which upgrade Puppet to version 2.6.18 and correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that the puppet package did not restrict the permissions and ownership of the /var/log/puppet directory, which may expose sensitive information.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201308-04 (Puppet: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Puppet. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
234379	RHEL 6 : puppet (RHSA-2013:0710)	Nessus	Red Hat Local Security Checks	high
82177	Debian DLA-29-1 : puppet security update	Nessus	Debian Local Security Checks	low
69464	GLSA-201308-04 : Puppet: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2012-6120

medium

Tenable Plugins

high

low

high