PT-2012-4695 · Puppet · Puppet+1

Kurt Seifried · Published 2012-08-06 · Updated 2022-01-24 · CVE-2012-3408

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Puppet versions prior to 2.7.18 Puppet Enterprise versions prior to 2.5.2

Description The issue allows remote attackers to potentially spoof an agent by acquiring a previously used IP address, as the software supports the use of IP addresses in certnames without warning of potential risks. This could be exploited by attackers to impersonate legitimate agents.

Recommendations For Puppet versions prior to 2.7.18, update to version 2.7.18 or later to resolve the issue. For Puppet Enterprise versions prior to 2.5.2, update to version 2.5.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of IP addresses in certnames to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2012-3408

GHSA-VXF6-W9MP-95HM

Affected Products

Puppet

Puppet Enterprise

References · 12

• 🔥 https://github.com/puppetlabs/puppet/commit/ab9150baa1b738467a33b01df1d90e076253fbbd · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2012-3408.yml · Exploit
• http://puppetlabs.com/security/cve/cve-2012-3408 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-3408 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2012-3408 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-3408 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vxf6-w9mp-95hm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-3408 · Vendor Advisory
• https://github.com/puppetlabs/puppet · Note
• https://puppet.com/security/cve/cve-2012-3408-agent-impersonation · Note
• https://t.me/cvenotify/25761 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=839166 · Note