Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."

Various security issues were fixed in puppet.

CVE-2013-1655 CVE-2013-2275 CVE-2013-1640 CVE-2013-1652 CVE-2013-1653 CVE-2013-1654 CVE-2013-1655 CVE-2013-2274 CVE-2013-2275

The remote host is affected by the vulnerability described in GLSA-201308-04 (Puppet: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Puppet. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

Security release from upstream.

https://groups.google.com/group/puppet-announce/browse_thread/thread/7 ff8326dc79257a1

update to 3.1.0 with proper handling of Systemd. Here is where you give an explanation of your update.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the Puppet install on the remote host has a remote code execution vulnerability.  Specially crafted YAML encoded objects are not unserialized safely.  A remote, unauthenticated attacker could exploit this to execute arbitrary code. 

The issue is reportedly only exploitable when Puppet has the master role enabled, and is configured to use Ruby 1.9.3 or later.

puppet has been updated to fix 2.6.18 multiple vulnerabilities and bugs.

  - (#19391) Find the catalog for the specified node name

  - Don't assume master supports SSLv2

  - Don't require openssl client to return 0 on failure

  - Display SSL messages so we can match our regex

  - Don't assume puppetbindir is defined

  - Remove unnecessary rubygems require

  - Run openssl from windows when trying to downgrade master

  - Separate tests for same CVEs into separate files

  - Fix order-dependent test failure in rest_authconfig_spec

  - Always read request body when using Rack

  - (#19392) (CVE-2013-1653) Fix acceptance test to catch     unvalidated model on 2.6

  - (#19392) (CVE-2013-1653) Validate indirection model in     save handler

  - Acceptance tests for CVEs 2013 (1640, 1652, 1653, 1654,     2274, 2275)

  - (#19531) (CVE-2013-2275) Only allow report save from the     node matching the certname

  - (#19391) Backport Request#remote? method

  - (#8858) Explicitly set SSL peer verification mode.

  - (#8858) Refactor tests to use real HTTP objects

  - (#19392) (CVE-2013-1653) Validate instances passed to     indirector

  - (#19391) (CVE-2013-1652) Disallow use_node compiler     parameter for remote requests

  - (#19151) Reject SSLv2 SSL handshakes and ciphers

  - (#14093) Restore access to the filename in the template

  - (#14093) Remove unsafe attributes from TemplateWrapper

Updates for the security announcements from Puppet Labs on 12-Mar-2013.

https://groups.google.com/group/puppet-announce/t/9200f268f8479e2c

This update also provides backported fixes for a number of issues with ruby-1.9.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Moses Mendoza reports :

A vulnerability found in Puppet could allow an authenticated client to cause the master to execute arbitrary code while responding to a catalog request. Specifically, in order to exploit the vulnerability, the puppet master must be made to invoke the 'template' or 'inline_template' functions during catalog compilation.

A vulnerability found in Puppet could allow an authenticated client to connect to a puppet master and perform unauthorized actions.
Specifically, given a valid certificate and private key, an agent could retrieve catalogs from the master that it is not authorized to access or it could poison the puppet master's caches for any puppet-generated data that supports caching such as catalogs, nodes, facts, and resources. The extent and severity of this vulnerability varies depending on the specific configuration of the master: for example, whether it is using storeconfigs or not, which version, whether it has access to the cache or not, etc.

A vulnerability has been found in Puppet which could allow authenticated clients to execute arbitrary code on agents that have been configured to accept kick connections. This vulnerability is not present in the default configuration of puppet agents, but if they have been configured to listen for incoming connections ('listen=true'), and the agent's auth.conf has been configured to allow access to the `run` REST endpoint, then a client could construct an HTTP request which could execute arbitrary code. The severity of this issue is exacerbated by the fact that puppet agents typically run as root.

A vulnerability has been found in Puppet that could allow a client negotiating a connection to a master to downgrade the master's SSL protocol to SSLv2. This protocol has been found to contain design weaknesses. This issue only affects systems running older versions (pre 1.0.0) of openSSL. Newer versions explicitly disable SSLv2.

A vulnerability found in Puppet could allow unauthenticated clients to send requests to the puppet master which would cause it to load code unsafely. While there are no reported exploits, this vulnerability could cause issues like those described in Rails CVE-2013-0156. This vulnerability only affects puppet masters running Ruby 1.9.3 and higher.

This vulnerability affects puppet masters 0.25.0 and above. By default, auth.conf allows any authenticated node to submit a report for any other node. This can cause issues with compliance. The defaults in auth.conf have been changed.

It was discovered that Puppet agents incorrectly handled certain kick connections in a non-default configuration. An attacker on an authenticated client could use this issue to possibly execute arbitrary code. (CVE-2013-1653)

It was discovered that Puppet incorrectly handled certain catalog requests. An attacker on an authenticated client could use this issue to possibly execute arbitrary code on the master. (CVE-2013-1640)

It was discovered that Puppet incorrectly handled certain client requests. An attacker on an authenticated client could use this issue to possibly perform unauthorized actions. (CVE-2013-1652)

It was discovered that Puppet incorrectly handled certain SSL connections. An attacker could use this issue to possibly downgrade connections to SSLv2. (CVE-2013-1654)

It was discovered that Puppet incorrectly handled serialized attributes. An attacker on an authenticated client could use this issue to possibly cause a denial of service, or execute arbitrary.
(CVE-2013-1655)

It was discovered that Puppet incorrectly handled submitted reports.
An attacker on an authenticated node could use this issue to possibly submit a report for any other node. (CVE-2013-2275).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities were discovered in Puppet, a centralized configuration management system.

  - CVE-2013-1640     An authenticated malicious client may request its     catalog from the puppet master, and cause the puppet     master to execute arbitrary code. The puppet master must     be made to invoke the 'template' or 'inline_template'     functions during catalog compilation.

  - CVE-2013-1652     An authenticated malicious client may retrieve catalogs     from the puppet master that it is not authorized to     access. Given a valid certificate and private key, it is     possible to construct an HTTP GET request that will     return a catalog for an arbitrary client.

  - CVE-2013-1653     An authenticated malicious client may execute arbitrary     code on Puppet agents that accept kick connections.
    Puppet agents are not vulnerable in their default     configuration. However, if the Puppet agent is     configured to listen for incoming connections, e.g.
    listen = true, and the agent's auth.conf allows access     to the 'run' REST endpoint, then an authenticated client     can construct an HTTP PUT request to execute arbitrary     code on the agent. This issue is made worse by the fact     that puppet agents typically run as root.

  - CVE-2013-1654     A bug in Puppet allows SSL connections to be downgraded     to SSLv2, which is known to contain design flaw     weaknesses. This affects SSL connections between puppet     agents and master, as well as connections that puppet     agents make to third-party servers that accept SSLv2     connections. Note that SSLv2 is disabled since OpenSSL     1.0.

  - CVE-2013-1655     An unauthenticated malicious client may send requests to     the puppet master, and have the master load code in an     unsafe manner. It only affects users whose puppet     masters are running ruby 1.9.3 and above.

  - CVE-2013-2274     An authenticated malicious client may execute arbitrary     code on the puppet master in its default configuration.
    Given a valid certificate and private key, a client can     construct an HTTP PUT request that is authorized to save     the client's own report, but the request will actually     cause the puppet master to execute arbitrary code.

  - CVE-2013-2275     The default auth.conf allows an authenticated node to     submit a report for any other node, which is a problem     for compliance. It has been made more restrictive by     default so that a node is only allowed to save its own     report.

ID	Name	Product	Family	Severity
74952	openSUSE Security Update : puppet (openSUSE-2013-295)	Nessus	SuSE Local Security Checks	high
69464	GLSA-201308-04 : Puppet: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
69189	Fedora 18 : puppet-3.1.1-1.fc18 (2013-3935)	Nessus	Fedora Local Security Checks	high
66236	Puppet Unsafe YAML Unserialization	Nessus	CGI abuses	high
65796	SuSE 11.2 Security Update : puppet (SAT Patch Number 7526)	Nessus	SuSE Local Security Checks	high
65749	Fedora 17 : puppet-2.7.21-2.fc17 (2013-4187)	Nessus	Fedora Local Security Checks	high
65542	FreeBSD : puppet27 and puppet -- multiple vulnerabilities (cda566a0-2df0-4eb0-b70e-ed7a6fb0ab3c)	Nessus	FreeBSD Local Security Checks	high
65251	Ubuntu 11.10 / 12.04 LTS / 12.10 : puppet vulnerabilities (USN-1759-1)	Nessus	Ubuntu Local Security Checks	high
65228	Debian DSA-2643-1 : puppet - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2013-1655

high

Tenable Plugins

high

high

high

high

high

high

high

high

high