PT-2014-1919 · Puppet+3 · Hiera+7

Published 2014-11-16 · Updated 2024-06-15 · CVE-2014-3248

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Medium

Base vector

AV:L/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions 2.8 through 2.8.6 Puppet versions 2.7.x through 2.7.25 and 3.x through 3.6.1 Facter versions 1.6.x through 1.6.x and 2.x through 2.0.1 Hiera versions prior to 1.3.4 Mcollective versions prior to 2.5.2

Description The issue allows local users to gain privileges via a Trojan horse file in the current working directory. This can be demonstrated using files such as rubygems/defaults/operating system.rb, Win32API.rb, Win32API.so, safe yaml.rb, safe yaml/deep.rb, safe yaml/deep.so, operatingsystem.rb, operatingsystem.so, osfamily.rb, or osfamily.so in puppet/confine. The vulnerability can be exploited when running with Ruby 1.9.1 or earlier.

Recommendations For Puppet Enterprise versions 2.8 through 2.8.6, update to version 2.8.7 or later. For Puppet versions 2.7.x through 2.7.25, update to version 2.7.26 or later. For Puppet versions 3.x through 3.6.1, update to version 3.6.2 or later. For Facter versions 1.6.x through 1.6.x, update to version 2.0.2 or later. For Facter versions 2.x through 2.0.1, update to version 2.0.2 or later. For Hiera versions prior to 1.3.4, update to version 1.3.4 or later. For Mcollective versions prior to 2.5.2, update to version 2.5.2 or later. As a temporary workaround, consider restricting access to the vulnerable files in the current working directory until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-17

Related Identifiers

BDU:2015-09786

CVE-2014-3248

GHSA-92V7-PQ4H-58J5

OPENSUSE-SU-2024:10565-1

OPENSUSE-SU-2024:10581-1

SUSE-RU-2015:0696-1

USN-3308-1

Affected Products

Facter

Hiera

Mcollective

Puppet

Puppet Enterprise

Ruby

Suse

Ubuntu

References · 28

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/facter/CVE-2014-3248.yml · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/hiera/CVE-2014-3248.yml · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2014-3248.yml · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/mcollective-client/CVE-2014-3248.yml · Exploit
• 🔥 http://rowediness.com/2014/06/13/cve-2014-3248-a-little-problem-with-puppet · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2024:10565-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-3248 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-2295 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-3248 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3308-1 · Vendor Advisory
• http://puppetlabs.com/security/cve/cve-2014-3248 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-3248 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-3248 · Security Note
• https://ubuntu.com/security/CVE-2014-3248 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-92v7-pq4h-58j5 · Vendor Advisory