Ubuntu 12.04 LTS USN-1506-1 Moderate Puppet Issues Detected

ubuntu

July 12, 2012

Several security issues were fixed in Puppet.

Summary

Several security issues were fixed in Puppet.

Software Description:

- puppet: Centralized configuration management

Details:

It was discovered that Puppet incorrectly handled certain HTTP GET

requests. An attacker could use this flaw with a valid client certificate

to retrieve arbitrary files from the Puppet master. (CVE-2012-3864)

It was discovered that Puppet incorrectly handled Delete requests. If a

Puppet master were reconfigured to allow the "Delete" method, an attacker

on an authenticated host could use this flaw to delete arbitrary files from

the Puppet server, leading to a denial of service. (CVE-2012-3865)

It was discovered that Puppet incorrectly set file permissions on the

last_run_report.yaml file. An attacker could use this flaw to access

sensitive information. This issue only affected Ubuntu 11.10 and Ubuntu

12.04 LTS. (CVE-2012-3866)

It was discovered that Puppet incorrectly handled agent certificate names.

An attacker could use this flaw ...

Read the Full Advisory

Topics Covered

security advisory denial of service file access ubuntu puppet

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  puppet-common                   2.7.11-1ubuntu2.1

Ubuntu 11.10:
  puppet-common                   2.7.1-1ubuntu3.7

Ubuntu 11.04:
  puppet-common                   2.6.4-2ubuntu2.10

Ubuntu 10.04 LTS:
  puppet-common                   0.25.4-2ubuntu6.8

In general, a standard system update will make all the necessary changes.