Puppet Enterprise CVE-2013-4967 Information Disclosure Vulnerability

Bugtraq ID:	61945
Class:	Design Error
CVE:	CVE-2013-4967
Remote:	Yes
Local:	No
Published:	Aug 15 2013 12:00AM
Updated:	Aug 15 2013 12:00AM
Credit:	Puppet Labs
Vulnerable:	Puppetlabs Puppet Enterprise 3.0 Puppetlabs Puppet Enterprise 2.8.3 Puppetlabs Puppet Enterprise 2.8.2 Puppetlabs Puppet Enterprise 2.7.2 Puppetlabs Puppet Enterprise 2.7.1 Puppetlabs Puppet Enterprise 2.7 Puppetlabs Puppet Enterprise 2.5.2 Puppetlabs Puppet Enterprise 2.5.1 Puppetlabs Puppet Enterprise 2.0.3 Puppetlabs Puppet Enterprise 2.0.2 Puppetlabs Puppet Enterprise 1.2.7 Puppetlabs Puppet Enterprise 2.8.0 Puppetlabs Puppet Enterprise 2.6 Puppetlabs Puppet Enterprise 1.2 Puppetlabs Puppet Enterprise 1.2 Puppetlabs Puppet Enterprise 1.1 Puppetlabs Puppet Enterprise 1.0 Puppetlabs Puppet Enterprise 2.0
Not Vulnerable:	Puppetlabs Puppet Enterprise 3.0.1

Puppet Enterprise CVE-2013-4967 Information Disclosure Vulnerability

Puppet Enterprise is prone to an information-disclosure vulnerability.

Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks.

Puppet Enterprise versions prior to 3.0.1 are vulnerable.

Puppet Enterprise CVE-2013-4967 Information Disclosure Vulnerability

An attacker can exploit this issue using a web browser.

Puppet Enterprise CVE-2013-4967 Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Puppet Enterprise CVE-2013-4967 Information Disclosure Vulnerability

References:

• CVE-2013-4967 (External Node Classifiers Allowed Clear Text Database Password Qu (Puppet Labs)
  
• Puppet Homepage (Puppet Labs)