FreeBSD : puppet -- multiple vulnerabilities (101f0aae-52d1-11e2-87fe-f4ce46b9ace8)

This script is Copyright (C) 2013-2015 Tenable Network Security, Inc.


Synopsis :

The remote FreeBSD host is missing a security-related update.

Description :

puppet -- multiple vulnerabilities

Arbitrary file read on the puppet master from authenticated clients
(high). It is possible to construct an HTTP get request from an
authenticated client with a valid certificate that will return the
contents of an arbitrary file on the Puppet master that the master has
read-access to.

Arbitrary file delete/D.O.S on Puppet Master from authenticated
clients (high). Given a Puppet master with the 'Delete' directive
allowed in auth.conf for an authenticated host, an attacker on that
host can send a specially crafted Delete request that can cause an
arbitrary file deletion on the Puppet master, potentially causing a
denial of service attack. Note that this vulnerability does *not*
exist in Puppet as configured by default.

Insufficient input validation for agent hostnames (low). An attacker
could trick the administrator into signing an attacker's certificate
rather than the intended one by constructing specially crafted
certificate requests containing specific ANSI control sequences. It is
possible to use the sequences to rewrite the order of text displayed
to an administrator such that display of an invalid certificate and
valid certificate are transposed. If the administrator signs the
attacker's certificate, the attacker can then man-in-the-middle the
agent.

See also :

http://www.nessus.org/u?a6a6c468
http://puppetlabs.com/security/cve/cve-2012-3864/
http://puppetlabs.com/security/cve/cve-2012-3865/
http://puppetlabs.com/security/cve/cve-2012-3867/
http://www.nessus.org/u?3f1c3b50

Solution :

Update the affected package.

Risk factor :

Medium / CVSS Base Score : 4.3
(CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)

Family: FreeBSD Local Security Checks

Nessus Plugin ID: 63368 ()

Bugtraq ID:

CVE ID: CVE-2012-3864
CVE-2012-3865
CVE-2012-3867

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now