PT-2009-1104 · Puppet · Puppet

Till Maas · Published 2009-10-06 · Updated 2024-06-10 · CVE-2009-3564

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions puppet versions prior to 2.7.11 puppet version 0.24.6

Description The issue concerns multiple vulnerabilities in the puppet package that can be exploited locally, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Specifically, in puppet 0.24.6, the puppetmasterd does not reset supplementary groups when switching to a different user. This might allow local users to access restricted files.

Recommendations For puppet versions prior to 2.7.11, update to version 2.7.11 or later to resolve the issue. For puppet version 0.24.6, consider restricting access to sensitive files and directories as a temporary workaround until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-09427

CVE-2009-3564

Affected Products

Puppet

References · 10

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=475201 · Exploit
• https://bdu.fstec.ru/vul/2015-09427 · Security Note
• https://osv.dev/vulnerability/CVE-2009-3564 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-3564 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-3564 · Vendor Advisory
• http://projects.reductivelabs.com/issues/1806 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3564 · Security Note
• https://puppet.com/security/cve/cve-2009-3564 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201203-03.xml · Note
• https://t.me/cvenotify/82645 · Telegram Post