USN-1506-1 : puppet vulnerabilities

NASLDB: USN-1506-1 : puppet vulnerabilities

General

ID: 59965
Name: USN-1506-1 : puppet vulnerabilities

Summary: Checks dpkg output for updated package(s)

Credits: –

Classification

Risk: –

CVSS: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS Base Vector: –
CVSS Temporal Vector: –

Port: 0
Family: Ubuntu Local Security Checks
Type: Local

Description

It was discovered that Puppet incorrectly handled certain HTTP GET
requests. An attacker could use this flaw with a valid client
certificate to retrieve arbitrary files from the Puppet master.
(CVE-2012-3864)

It was discovered that Puppet incorrectly handled Delete requests. If
a Puppet master were reconfigured to allow the ‘Delete’ method, an
attacker on an authenticated host could use this flaw to delete
arbitrary files from the Puppet server, leading to a denial of
service. (CVE-2012-3865)

It was discovered that Puppet incorrectly set file permissions on the
last_run_report.yaml file. An attacker could use this flaw to access
sensitive information. This issue only affected Ubuntu 11.10 and
Ubuntu 12.04 LTS. (CVE-2012-3866)

It was discovered that Puppet incorrectly handled agent certificate
names. An attacker could use this flaw to create a specially crafted
certificate and trick an administrator into signing a certificate
that can then be used to man-in-the-middle agent nodes.
(CVE-2012-3867)