PT-2009-1104 · Puppet · Puppet

Till Maas · Publicado 2009-10-06 · Atualizado 2024-06-10 · CVE-2009-3564

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions puppet versions prior to 2.7.11 puppet version 0.24.6

Description The issue concerns multiple vulnerabilities in the puppet package that can be exploited locally, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Specifically, in puppet 0.24.6, the puppetmasterd does not reset supplementary groups when switching to a different user. This might allow local users to access restricted files.

Recommendations For puppet versions prior to 2.7.11, update to version 2.7.11 or later to resolve the issue. For puppet version 0.24.6, consider restricting access to sensitive files and directories as a temporary workaround until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2015-09427

CVE-2009-3564

Produtos afetados

Puppet

Referências · 10

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=475201 · Exploit
• https://bdu.fstec.ru/vul/2015-09427 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2009-3564 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2009-3564 · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-201203-03.xml · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-3564 · Aviso do Fabricante
• http://projects.reductivelabs.com/issues/1806 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-3564 · Nota de Segurança
• https://t.me/cvenotify/82645 · Publicação no Telegram
• https://puppet.com/security/cve/cve-2009-3564 · Aviso do Fabricante