Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:1284 advisory.

  - puppet: remote code execution on master from unauthenticated clients (CVE-2013-3567)

  - Puppet: resource_type service code execution (CVE-2013-4761)

  - Puppet: Local Privilege Escalation/Arbitrary Code Execution (CVE-2013-4956)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A potential remote code execution via YAML was fixed in puppet.
(CVE-2013-3567)

According to its self-reported version number, the Puppet install on the remote host has a remote code execution vulnerability. When making REST API calls, the puppet master takes YAML from an untrusted client, deserializes it, and then calls methods on the resulting object. A YAML payload can be crafted to cause the deserialization to construct an instance of any class available in the ruby process, which allows an attacker to execute code contained in the payload.

The remote host is affected by the vulnerability described in GLSA-201308-04 (Puppet: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Puppet. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

This puppet update fixes a remote code execution issue :

  - Unauthenticated Remote Code Execution Vulnerability with     YAML and REST API calls (bug#825878, CVE-2013-3567)

Updated puppet packages fix remote code execution vulnerability

When making REST api calls, the puppet master takes YAML from an untrusted client, deserializes it, and then calls methods on the resulting object. A YAML payload can be crafted to cause the deserialization to construct an instance of any class available in the ruby process, which allows an attacker to execute code contained in the payload (CVE-2013-3567).

It was discovered that puppet, a centralized configuration management system, did not correctly handle YAML payloads. A remote attacker could use a specially crafted payload to execute arbitrary code on the puppet master.

Puppet Developers report :

When making REST api calls, the puppet master takes YAML from an untrusted client, deserializes it, and then calls methods on the resulting object. A YAML payload can be crafted to cause the deserialization to construct an instance of any class available in the ruby process, which allows an attacker to execute code contained in the payload.

It was discovered that Puppet incorrectly handled YAML payloads. An attacker on an untrusted client could use this issue to execute arbitrary code on the master.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
193828	RHEL 6 : ruby193-puppet (RHSA-2013:1284)	Nessus	Red Hat Local Security Checks	high
75125	openSUSE Security Update : puppet (openSUSE-SU-2013:1370-1)	Nessus	SuSE Local Security Checks	high
70662	Puppet Unauthenticated Remote Code Execution	Nessus	CGI abuses	high
69771	Amazon Linux AMI : puppet (ALAS-2013-213)	Nessus	Amazon Linux Local Security Checks	high
69464	GLSA-201308-04 : Puppet: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
69233	SuSE 11.2 / 11.3 Security Update : puppet / puppet, puppet-server (SAT Patch Numbers 8131 / 8132)	Nessus	SuSE Local Security Checks	high
67104	Mandriva Linux Security Advisory : puppet (MDVSA-2013:186)	Nessus	Mandriva Local Security Checks	high
67100	Debian DSA-2715-1 : puppet - code execution	Nessus	Debian Local Security Checks	high
66966	FreeBSD : puppet -- Unauthenticated Remote Code Execution Vulnerability (b162b218-c547-4ba2-ae31-6fdcb61bc763)	Nessus	FreeBSD Local Security Checks	high
66924	Ubuntu 12.04 LTS / 12.10 / 13.04 : puppet vulnerability (USN-1886-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2013-3567

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high