Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Ubuntu 10.04 LTS: USN-1223-2 Moderate Puppet SSH Management Regression

ubuntu
Calendar Grey October 5, 2011
Scroller Ubuntu
Addresses issue in handling SSH authorized_keys files triggered by USN-1223-1 on Ubuntu 10.04 LTS using Puppet.
USN-1223-1 caused a regression with managing SSH authorized_keys files.

Summary

USN-1223-1 caused a regression with managing SSH authorized_keys files.

Software Description:

- puppet: Centralized configuration management

Details:

USN-1223-1 fixed vulnerabilities in Puppet. A regression was found on

Ubuntu 10.04 LTS that caused permission denied errors when managing SSH

authorized_keys files with Puppet. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

It was discovered that Puppet unsafely opened files when the k5login type

is used to manage files. A local attacker could exploit this to overwrite

arbitrary files which could be used to escalate privileges. (CVE-2011-3869)

Ricky Zhou discovered that Puppet did not drop privileges when creating

SSH authorized_keys files. A local attacker could exploit this to overwrite

arbitrary files as root. (CVE-2011-3870)

It was discovered that Puppet used a predictable filename when using the

--edit resource. A local attacker could exploi...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory ubuntu regression puppet SSH file management

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 10.04 LTS:
  puppet-common                   0.25.4-2ubuntu6.4

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-1223-2

https://ubuntu.com/security/notices/USN-1223-1

https://bugs.launchpad.net/ubuntu/+source/puppet/+bug/865462

October 05, 2011

Topics%20covered

Topics Covered

security advisory ubuntu regression puppet SSH file management

Package Information

https://launchpad.net/ubuntu/+source/puppet/0.25.4-2ubuntu6.4

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.