PT-2013-1225 · Red Hat+1 · Red Hat Openstack+1

Published 2013-04-10 · Updated 2013-08-23 · CVE-2012-6120

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Red Hat OpenStack versions Essex and Folsom Puppet versions prior to 2.7.23

Description The issue allows local users to obtain sensitive information, such as Puppet log files, due to the world-readable permissions of the /var/log/puppet directory. Additionally, multiple vulnerabilities in the Puppet package can lead to breaches of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely by an authenticated attacker.

Recommendations For Red Hat OpenStack versions Essex and Folsom, consider changing the permissions of the /var/log/puppet directory to restrict access to sensitive information. For Puppet versions prior to 2.7.23, update to version 2.7.23 or later to resolve the vulnerabilities.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-09724

CVE-2012-6120

DLA-29-1

RHSA-2013:0710

Affected Products

Puppet

Red Hat Openstack

References · 7

• http://rhn.redhat.com/errata/RHSA-2013-0710.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-6120 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09724 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-6120 · Security Note
• https://osv.dev/vulnerability/CVE-2012-6120 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-6120 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201308-04.xml · Note