Puppet CVE-2013-4761 Arbitrary Code Execution Vulnerability
BID:61806
Info
Puppet CVE-2013-4761 Arbitrary Code Execution Vulnerability
| Bugtraq ID: | 61806 |
| Class: | Unknown |
| CVE: |
CVE-2013-4761 |
| Remote: | No |
| Local: | Yes |
| Published: | Aug 15 2013 12:00AM |
| Updated: | Mar 19 2015 09:44AM |
| Credit: | Moses Mendoza |
| Vulnerable: |
Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 SuSE SUSE Linux Enterprise Server 11 SP2 SuSE SUSE Linux Enterprise Desktop 11 SP2 Puppet Labs Puppet Enterprise 2.5.1 Puppet Labs Puppet Enterprise 2.0.3 Puppet Labs Puppet Enterprise 2.0.2 Puppet Labs Puppet Enterprise 2.6 Puppet Labs Puppet Enterprise 1.2 Puppet Labs Puppet Enterprise 1.1 Puppet Labs Puppet Enterprise 1.0 Puppet Labs Puppet Enterprise 2.0 Puppet Labs Puppet 2.7.13 Puppet Labs Puppet 2.7.11 Puppet Labs Puppet 2.7.10 Puppet Labs Puppet 2.6.15 Puppet Labs Puppet 2.6.14 Puppet Labs Puppet 2.6.13 Puppet Labs Puppet 2.6.11 Puppet Labs Puppet 2.6.10 Puppet Labs Puppet 2.6.4 Puppet Labs Puppet 2.6.3 Puppet Labs Puppet 2.6 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 |
| Not Vulnerable: | |
Discussion
Puppet CVE-2013-4761 Arbitrary Code Execution Vulnerability
Puppet is prone to an arbitrary code-execution vulnerability.
Successfully exploiting this issue will allow attackers to execute arbitrary code within the context of the application.
The issue is fixed in the following versions:
Puppet 2.7.23 and 3.2.4
Puppet Enterprise 2.8.3 and 3.0.1
Puppet is prone to an arbitrary code-execution vulnerability.
Successfully exploiting this issue will allow attackers to execute arbitrary code within the context of the application.
The issue is fixed in the following versions:
Puppet 2.7.23 and 3.2.4
Puppet Enterprise 2.8.3 and 3.0.1
Exploit / POC
Puppet CVE-2013-4761 Arbitrary Code Execution Vulnerability
An attacker requires local file system access to the Puppet Master to exploit this issue.
An attacker requires local file system access to the Puppet Master to exploit this issue.
Solution / Fix
Puppet CVE-2013-4761 Arbitrary Code Execution Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Mandriva Business Server 1 X86 64
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Mandriva Business Server 1 X86 64
-
Mandriva puppet-2.7.23-1.mbs1.noarch.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva puppet-server-2.7.23-1.mbs1.noarch.rpm
http://www.mandriva.com/en/downloads/
References
Puppet CVE-2013-4761 Arbitrary Code Execution Vulnerability
References:
References:
- Bug 996856 - (CVE-2013-4761) CVE-2013-4761 Puppet: resource_type service code ex (Kurt Seifried )
- CVE-2013-4761 (`resource_type` Remote Code Execution Vulnerability) (puppetlabs)
- Multiple vulnerabilities in Puppet (Oracle)
- Puppet Homepage (Puppet Labs)
- Security Advisory Critical: ruby193-puppet security update (Red Hat)
- Security Advisory Moderate: puppet security update (Red Hat)
- Security update for puppet (SUSE)