Versions of MCollective prior to 2.10.4 deserialized YAML from agents without calling safe_load, allowing the potential for arbitrary code execution on the server. The fix for this is to call YAML.safe_load on input. This has been tested in all Puppet-supplied MCollective plugins, but there is a chance that third-party plugins could rely on this insecure behavior.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Versions of MCollective prior to 2.10.4 deserialized YAML from agents without calling safe_load, allowing     the potential for arbitrary code execution on the server. The fix for this is to call YAML.safe_load on     input. This has been tested in all Puppet-supplied MCollective plugins, but there is a chance that third-     party plugins could rely on this insecure behavior. (CVE-2017-2292)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to its self-reported version number, the Puppet install on the remote host is affected by multiple vulnerabilities :

  - A remote command execution vulnerability exists in the MCollective plugin     due to unsafe YAML deserialization. An unauthenticated, remote attacker     can exploit this to bypass authentication and execute arbitrary commands.     (CVE-2017-2292, CVE-2017-2295)

  - An arbitrary package install vulnerability exists in the MCollective plugin     due to unsafe default configuration. An unauthenticated, remote attacker     can exploit this to install or remove packages on all managed agents.
    (CVE-2017-2293)

  - An information disclosure vulnerability exists in the MCollective plugin     due to unsafe storage of server private keys. An unauthenticated, remote attacker     can exploit this to view sensitive private keys.
    (CVE-2017-2294)   
  - An authentication bypass vulnerability exists in labled RBAC access tokens.     An unauthenticated, attacker can exploit this, to bypass authentication     and execute arbitrary actions of users configured to use labeled RBAC     access tokens. This issue has been fixed in Puppet Enterprise 2016.4.5     and 2017.2.1. This only affects users with labeled tokens, which is     not the default for tokens. (CVE-2017-2297)

The remote host is affected by the vulnerability described in GLSA-201709-01 (MCollective: Remote Code Execution)

    A vulnerability was discovered in MCollective which allowed for       deserialized YAML from agents without calling safe_load. This allows the       potential for arbitrary code execution on the server.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
254966	Linux Distros Unpatched Vulnerability : CVE-2017-2292	Nessus	Misc.	critical
129755	Puppet Enterprise < 2016.4.5 / 2016.5.x / 2017.1.x Multiple Vulnerabilities	Nessus	CGI abuses	critical
102942	GLSA-201709-01 : MCollective: Remote Code Execution	Nessus	Gentoo Local Security Checks	critical

Detections

Analytics

CVE-2017-2292

critical

Tenable Plugins

critical

critical

critical