PT-2012-1099 · Puppet+2 · Puppet+3

Published 2012-03-06 · Updated 2019-07-11 · CVE-2012-1054

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Puppet versions 2.6.x through 2.6.13 Puppet versions 2.7.x through 2.7.10 Puppet Enterprise (PE) Users versions 1.0 through 1.2.x Puppet Enterprise (PE) Users versions 2.0.x through 2.0.2

Description The issue affects the puppet package in Gentoo Linux and allows local users to gain privileges via a symlink attack on .k5login when managing a user login file with the k5login resource type. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation can be carried out locally.

Recommendations For Puppet versions 2.6.x through 2.6.13, update to version 2.6.14 or later. For Puppet versions 2.7.x through 2.7.10, update to version 2.7.11 or later. For Puppet Enterprise (PE) Users versions 1.0 through 1.2.x, update to a version after 2.0.2. For Puppet Enterprise (PE) Users versions 2.0.x through 2.0.2, update to version 2.0.3 or later. As a temporary workaround, consider restricting access to the k5login resource type until a patch is available.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-09427

CVE-2012-1054

DSA-2419-1

Affected Products

Gentoo Linux

Puppet

Puppet Enterprise (Pe) Users

Suse

References · 20

• http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html · Vendor Advisory
• http://secunia.com/advisories/48166 · Vendor Advisory
• http://secunia.com/advisories/48290 · Vendor Advisory
• http://debian.org/security/2012/dsa-2419 · Vendor Advisory
• http://puppetlabs.com/security/cve/cve-2012-1054 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-1054 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09427 · Security Note
• http://secunia.com/advisories/48157 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-1054 · Security Note
• https://hermes.opensuse.org/messages/15087408 · Vendor Advisory
• http://ubuntu.com/usn/usn-1372-1 · Vendor Advisory
• http://projects.puppetlabs.com/issues/12460 · Vendor Advisory
• http://secunia.com/advisories/48161 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-1054 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-1054 · Vendor Advisory