Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick enabled, via a crafted request for a report.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0710 advisory.

    Puppet allows provisioning, patching, and configuration of clients to be     managed and automated.

    A flaw was found in how Puppet handled certain HTTP PUT requests. An     attacker with valid authentication credentials, and authorized to save to     the authenticated client's own report, could construct a malicious request     that could possibly cause the Puppet master to execute arbitrary code.
    (CVE-2013-2274)

    A flaw was found in how Puppet handled the template and inline_template     functions during catalog compilation. If an authenticated attacker were to     requests its catalog from the Puppet master, it could possibly result in     arbitrary code execution when the catalog is compiled. (CVE-2013-1640)

    A flaw was found in how Puppet handled certain HTTP GET requests. An     attacker with valid authentication credentials could construct a request to     retrieve catalogs from the Puppet master that they are not authorized to     access. (CVE-2013-1652)

    It was found that the default /etc/puppet/auth.conf configuration file     allowed an authenticated node to submit a report for any other node, which     could breach compliance requirements. (CVE-2013-2275)

    It was found that the /var/log/puppet directory was created world-readable.
    This could allow local users to obtain sensitive information from the     Puppet log files. (CVE-2012-6120)

    It was found that Puppet allowed the use of the SSLv2 protocol. A Puppet     agent could use this to negotiate the use of the weak SSLv2 protocol for     its connection to a Puppet master. (CVE-2013-1654)

    Red Hat would like to thank Puppet Labs for reporting CVE-2013-1640,     CVE-2013-1652, CVE-2013-1654, CVE-2013-2274, and CVE-2013-2275.

    Note: In most default configurations these issues are not directly     exploitable unless the attacker has access to the underlying OpenStack     infrastructure (e.g. shell access to a Nova compute node).

    Users of Red Hat OpenStack Folsom are advised to upgrade to these updated     packages, which upgrade Puppet to version 2.6.18 and correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Various security issues were fixed in puppet.

CVE-2013-1655 CVE-2013-2275 CVE-2013-1640 CVE-2013-1652 CVE-2013-1653 CVE-2013-1654 CVE-2013-1655 CVE-2013-2274 CVE-2013-2275

The remote host is affected by the vulnerability described in GLSA-201308-04 (Puppet: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Puppet. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

puppet has been updated to fix 2.6.18 multiple vulnerabilities and bugs.

  - (#19391) Find the catalog for the specified node name

  - Don't assume master supports SSLv2

  - Don't require openssl client to return 0 on failure

  - Display SSL messages so we can match our regex

  - Don't assume puppetbindir is defined

  - Remove unnecessary rubygems require

  - Run openssl from windows when trying to downgrade master

  - Separate tests for same CVEs into separate files

  - Fix order-dependent test failure in rest_authconfig_spec

  - Always read request body when using Rack

  - (#19392) (CVE-2013-1653) Fix acceptance test to catch     unvalidated model on 2.6

  - (#19392) (CVE-2013-1653) Validate indirection model in     save handler

  - Acceptance tests for CVEs 2013 (1640, 1652, 1653, 1654,     2274, 2275)

  - (#19531) (CVE-2013-2275) Only allow report save from the     node matching the certname

  - (#19391) Backport Request#remote? method

  - (#8858) Explicitly set SSL peer verification mode.

  - (#8858) Refactor tests to use real HTTP objects

  - (#19392) (CVE-2013-1653) Validate instances passed to     indirector

  - (#19391) (CVE-2013-1652) Disallow use_node compiler     parameter for remote requests

  - (#19151) Reject SSLv2 SSL handshakes and ciphers

  - (#14093) Restore access to the filename in the template

  - (#14093) Remove unsafe attributes from TemplateWrapper

Moses Mendoza reports :

A vulnerability found in Puppet could allow an authenticated client to cause the master to execute arbitrary code while responding to a catalog request. Specifically, in order to exploit the vulnerability, the puppet master must be made to invoke the 'template' or 'inline_template' functions during catalog compilation.

A vulnerability found in Puppet could allow an authenticated client to connect to a puppet master and perform unauthorized actions.
Specifically, given a valid certificate and private key, an agent could retrieve catalogs from the master that it is not authorized to access or it could poison the puppet master's caches for any puppet-generated data that supports caching such as catalogs, nodes, facts, and resources. The extent and severity of this vulnerability varies depending on the specific configuration of the master: for example, whether it is using storeconfigs or not, which version, whether it has access to the cache or not, etc.

A vulnerability has been found in Puppet that could allow a client negotiating a connection to a master to downgrade the master's SSL protocol to SSLv2. This protocol has been found to contain design weaknesses. This issue only affects systems running older versions (pre 1.0.0) of openSSL. Newer versions explicitly disable SSLv2.

A vulnerability found in Puppet could allow an authenticated client to execute arbitrary code on a puppet master that is running in the default configuration, or an agent with `puppet kick` enabled.
Specifically, a properly authenticated and connected puppet agent could be made to construct an HTTP PUT request for an authorized report that actually causes the execution of arbitrary code on the master.

This vulnerability affects puppet masters 0.25.0 and above. By default, auth.conf allows any authenticated node to submit a report for any other node. This can cause issues with compliance. The defaults in auth.conf have been changed.

Multiple vulnerabilities were discovered in Puppet, a centralized configuration management system.

  - CVE-2013-1640     An authenticated malicious client may request its     catalog from the puppet master, and cause the puppet     master to execute arbitrary code. The puppet master must     be made to invoke the 'template' or 'inline_template'     functions during catalog compilation.

  - CVE-2013-1652     An authenticated malicious client may retrieve catalogs     from the puppet master that it is not authorized to     access. Given a valid certificate and private key, it is     possible to construct an HTTP GET request that will     return a catalog for an arbitrary client.

  - CVE-2013-1653     An authenticated malicious client may execute arbitrary     code on Puppet agents that accept kick connections.
    Puppet agents are not vulnerable in their default     configuration. However, if the Puppet agent is     configured to listen for incoming connections, e.g.
    listen = true, and the agent's auth.conf allows access     to the 'run' REST endpoint, then an authenticated client     can construct an HTTP PUT request to execute arbitrary     code on the agent. This issue is made worse by the fact     that puppet agents typically run as root.

  - CVE-2013-1654     A bug in Puppet allows SSL connections to be downgraded     to SSLv2, which is known to contain design flaw     weaknesses. This affects SSL connections between puppet     agents and master, as well as connections that puppet     agents make to third-party servers that accept SSLv2     connections. Note that SSLv2 is disabled since OpenSSL     1.0.

  - CVE-2013-1655     An unauthenticated malicious client may send requests to     the puppet master, and have the master load code in an     unsafe manner. It only affects users whose puppet     masters are running ruby 1.9.3 and above.

  - CVE-2013-2274     An authenticated malicious client may execute arbitrary     code on the puppet master in its default configuration.
    Given a valid certificate and private key, a client can     construct an HTTP PUT request that is authorized to save     the client's own report, but the request will actually     cause the puppet master to execute arbitrary code.

  - CVE-2013-2275     The default auth.conf allows an authenticated node to     submit a report for any other node, which is a problem     for compliance. It has been made more restrictive by     default so that a node is only allowed to save its own     report.

ID	Name	Product	Family	Severity
234379	RHEL 6 : puppet (RHSA-2013:0710)	Nessus	Red Hat Local Security Checks	high
74952	openSUSE Security Update : puppet (openSUSE-2013-295)	Nessus	SuSE Local Security Checks	high
69464	GLSA-201308-04 : Puppet: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
65796	SuSE 11.2 Security Update : puppet (SAT Patch Number 7526)	Nessus	SuSE Local Security Checks	high
65540	FreeBSD : puppet26 -- multiple vulnerabilities (04042f95-14b8-4382-a8b9-b30e365776cf)	Nessus	FreeBSD Local Security Checks	high
65228	Debian DSA-2643-1 : puppet - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2013-2274

medium

Tenable Plugins

high

high

high

high

high

high