CVSS: 6.0EPSS: 0%CPEs: 13EXPL: 0CVE-2012-1988 – puppet: Filebucket arbitrary code execution
https://notcve.org/view.php?id=CVE-2012-1988
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full pathname contains shell metacharacters, then performing a filebucket request. Puppet v2.6.x anterior a v2.6.15 y v2.7.x anterior a v2.7.13, y Puppet Enterprise (PE) Users v1.0, v1.1, v1.2.x, v2.0.x, y v2.5.x anterior a v2.5.1 permite a usuarios remotos autenticados con el agente de claves SSL y permisos de creación de archivos en el puppet maestro ejecutar comandos arbitrarios mediante la creación de un archivo cuyo nombre de ruta completo contiene metacaracteres de shell, para realizar una solicitud "filebucket". telnet.rb en v2.7.x anterior a v2.7.13 y Puppet Enterprise (PE) v1.2.x, v2.0.x y v2.5.x anterior a v2.5.1 permite a usuarios locales sobreescribir ficheros arbitrarios mediante un ataque de enlace simbólico en el log de registro NET::Telnet (/tmp/out.log). • http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html http://projects.puppetlabs.com/issues/13518 http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15 http://puppetlabs.com/security/cve/cve-2012-1988 http://secunia.com/advisories/48743 http://secunia.com/advisories/48748 http://secunia.com/adv • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.9EPSS: 0%CPEs: 35EXPL: 0CVE-2012-1053
https://notcve.org/view.php?id=CVE-2012-1053
The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors related to (1) the change_user not dropping supplementary groups in certain conditions, (2) changes to the eguid without associated changes to the egid, or (3) the addition of the real gid to supplementary groups. El método change_user en el SUIDManager SUIDManager (lib/puppet/util/suidmanager.rb) en Puppet v2.6.x anterior a v2.6.14 y v2.7.x anterior a v2.7.11, y Puppet Enterprise (PE) Users v1.0, v1.1, v1.2.x, v2.0.x anterior a 2.0.3 no gestiona adecuadamente los privilegios de grupo, lo que permite a usuarios locales conseguir privilegios a través de vectores relacionados con (1) change_user en ciertas condiciones, (2) cambios en el eguid sin cambios asociados a la egid, o (3) la adición de la gid real a grupos complementarios. • http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html http://projects.puppetlabs.com/issues/12457 http://projects.puppetlabs.com/issues/12458 http://projects.puppetlabs.com/issues/12459 http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14 http://puppetlabs.com/security/cve/cve-2012-1053 http://secunia.com/advisories/48157 http://secunia.com/advisories/48161 http://secunia.com/advisories/48166 http://secunia.com/advisories/48290 http://ubuntu. • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.4EPSS: 0%CPEs: 35EXPL: 0CVE-2012-1054
https://notcve.org/view.php?id=CVE-2012-1054
Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a user login file with the k5login resource type, allows local users to gain privileges via a symlink attack on .k5login. Puppet v2.6.x anterior a v2.6.15 y v2.7.x anterior a v2.7.13, y Puppet Enterprise (PE) Users v1.0, v1.1, v1.2.x, v2.0.x anterior a v2.0.3, en la gestión de un archivo de inicio de sesión del usuario con el tipo de recurso k5login, permite a usuarios locales conseguir privilegios a través de un ataque de enlaces simbólicos en .k5login. • http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html http://projects.puppetlabs.com/issues/12460 http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14 http://puppetlabs.com/security/cve/cve-2012-1054 http://secunia.com/advisories/48157 http://secunia.com/advisories/48161 http://secunia.com/advisories/48166 http://secunia.com/advisories/48290 http://ubuntu.com/usn/usn-1372-1 http://www.debian.org/security/2012/dsa-2419 http://www. • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2011-0528
https://notcve.org/view.php?id=CVE-2011-0528
Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources of other nodes via unspecified vectors. Puppet 2.6.0 hasta 2.6.3 no restringe debidamente el acceso a los recursos de nodo, lo que permite a nodos Puppet remotos autenticados leer o modificar los recursos de otros nodos a través de vectores no especificados. • http://www.mail-archive.com/puppet-users%40googlegroups.com/msg16429.html http://www.openwall.com/lists/oss-security/2011/01/27/6 http://www.openwall.com/lists/oss-security/2011/01/31/5 http://www.ubuntu.com/usn/USN-1365-1 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 2.6EPSS: 0%CPEs: 24EXPL: 0CVE-2011-3872
https://notcve.org/view.php?id=CVE-2011-3872
Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof a Puppet master via a man-in-the-middle (MITM) attack against an agent that uses an alternate DNS name for the master, aka "AltNames Vulnerability." Puppet v2.6.x antes de v2.6.12 y v2.7.x antes de v2.7.6, y Puppet Enterprise (PE) Users v1.0, v1.1, y v1.2 antes de v1.2.4, al firmar un certificado de agente, añade los valores de Puppet master's certdnsnames al campo X.509 Subject Alternative Name, lo que permite a atacantes remotos falsificar un Puppet master a través de un ataque "Man-in-the-middle" contra un agente que utilice un nombre alternativo de DNS para el maestro, también conocido como "Vulnerabilidad AltNames." • http://groups.google.com/group/puppet-announce/browse_thread/thread/e7edc3a71348f3e1 http://puppetlabs.com/blog/important-security-announcement-altnames-vulnerability http://secunia.com/advisories/46550 http://secunia.com/advisories/46578 http://secunia.com/advisories/46934 http://secunia.com/advisories/46964 http://www.securityfocus.com/bid/50356 http://www.ubuntu.com/usn/USN-1238-1 http://www.ubuntu.com/usn/USN-1238-2 https://exchange.xforce.ibmcloud.com/vulnerabilities/70970 https:/&# • CWE-20: Improper Input Validation •