Puppet Enterprise CVE-2013-4959 Multiple Local Information Disclosure Vulnerabilities

Bugtraq ID:	61862
Class:	Design Error
CVE:	CVE-2013-4959
Remote:	No
Local:	Yes
Published:	Aug 15 2013 12:00AM
Updated:	Mar 19 2015 08:51AM
Credit:	The vendor reported these issues.
Vulnerable:	Puppet Labs Puppet Enterprise 2.5.1 Puppet Labs Puppet Enterprise 2.0.3 Puppet Labs Puppet Enterprise 2.0.2 Puppet Labs Puppet Enterprise 2.6 Puppet Labs Puppet Enterprise 1.2 Puppet Labs Puppet Enterprise 1.1 Puppet Labs Puppet Enterprise 1.0 Puppet Labs Puppet Enterprise 2.0
Not Vulnerable:

Puppet Enterprise CVE-2013-4959 Multiple Local Information Disclosure Vulnerabilities

Puppet is prone to multiple local information-disclosure vulnerabilities.

Exploiting these issues may allow a local attacker to obtain sensitive information that may aid in further attacks.

Versions prior to Puppet Enterprise 3.0.1 are vulnerable.

Puppet Enterprise CVE-2013-4959 Multiple Local Information Disclosure Vulnerabilities

Attackers require local interactive access to exploit these issues.

Puppet Enterprise CVE-2013-4959 Multiple Local Information Disclosure Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Puppet Enterprise CVE-2013-4959 Multiple Local Information Disclosure Vulnerabilities

References:

• CVE-2013-4959 (Sensitive Data Browser Caching) (Puppet Labs)
  
• Puppet Homepage (Puppet Labs)