PT-2012-4695 · Puppet · Puppet+1

Kurt Seifried · Publicado 2012-08-06 · Atualizado 2022-01-24 · CVE-2012-3408

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Puppet versions prior to 2.7.18 Puppet Enterprise versions prior to 2.5.2

Description The issue allows remote attackers to potentially spoof an agent by acquiring a previously used IP address, as the software supports the use of IP addresses in certnames without warning of potential risks. This could be exploited by attackers to impersonate legitimate agents.

Recommendations For Puppet versions prior to 2.7.18, update to version 2.7.18 or later to resolve the issue. For Puppet Enterprise versions prior to 2.5.2, update to version 2.5.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of IP addresses in certnames to minimize the risk of exploitation.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2012-3408

GHSA-VXF6-W9MP-95HM

Produtos afetados

Puppet

Puppet Enterprise

Referências · 12

• 🔥 https://github.com/puppetlabs/puppet/commit/ab9150baa1b738467a33b01df1d90e076253fbbd · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2012-3408.yml · Exploit
• https://github.com/puppetlabs/puppet · Nota
• http://puppetlabs.com/security/cve/cve-2012-3408 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-3408 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2012-3408 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-3408 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-vxf6-w9mp-95hm · Aviso do Fabricante
• https://puppet.com/security/cve/cve-2012-3408-agent-impersonation · Nota
• https://t.me/cvenotify/25761 · Publicação no Telegram
• https://bugzilla.redhat.com/show_bug.cgi?id=839166 · Nota
• https://osv.dev/vulnerability/CVE-2012-3408 · Aviso do Fabricante