Puppet Enterprise 3.x < 3.1.2 DTLS Retransmission DoS

Medium Nessus Plugin ID 73133

Synopsis

A web application on the remote host is affected by a denial of service vulnerability.

Description

According to its self-reported version number, the Puppet Enterprise 3.x install on the remote host is prior to 3.1.2. As a result, it is reportedly affected by an error related to the included OpenSSL version and DTLS retransmission processing that could allow denial of service attacks.

Solution

Upgrade to Puppet Enterprise 3.1.2 or later.

See Also

http://www.nessus.org/u?a6ceafd4

https://puppet.com/security/cve/cve-2013-6450

Plugin Details

Severity: Medium

ID: 73133

File Name: puppet_enterprise_312.nasl

Version: 1.3

Type: remote

Family: CGI abuses

Published: 2014/03/21

Updated: 2018/11/15

Dependencies: 66233

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:puppetlabs:puppet

Required KB Items: puppet/rest_port

Exploit Available: false

Exploit Ease: No exploit is required

Patch Publication Date: 2014/01/30

Vulnerability Publication Date: 2013/12/21

Reference Information

CVE: CVE-2013-6450

BID: 64618