PT-2014-2106 · Puppet · Puppet

Moritz · Publicado 2014-02-17 · Atualizado 2022-05-14 · CVE-2011-0528

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Puppet versions 2.6.0 through 2.6.3

Description The issue allows remote authenticated Puppet nodes to read or modify the resources of other nodes due to improper access restrictions to node resources.

Recommendations For Puppet versions 2.6.0 through 2.6.3, update to a version that properly restricts access to node resources to prevent unauthorized reading or modification of node resources.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

CWE-264

Identificadores relacionados

CVE-2011-0528

GHSA-9PVX-FWWH-W289

Produtos afetados

Puppet

Referências · 13

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2011-0528.yml · Exploit
• https://github.com/puppetlabs/puppet · Nota
• https://github.com/puppetlabs/puppet/commit/eee1a9cdaa5cab6222c8e6ab087d319f976fa4e3 · Nota
• http://mail-archive.com/[e-mail]/msg16429.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-0528 · Nota de Segurança
• http://mail-archive.com/puppet-users%40googlegroups.com/msg16429.html · Nota
• https://security-tracker.debian.org/tracker/CVE-2011-0528 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-9pvx-fwwh-w289 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-0528 · Aviso do Fabricante
• http://ubuntu.com/usn/USN-1365-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2011-0528 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2011/01/31/5 · Nota
• http://openwall.com/lists/oss-security/2011/01/27/6 · Nota