CVE-2012-1988

Опубликовано: 29 мая 2012

Источник: nvd

CVSS2: 6

EPSS Низкий

Описание

Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full pathname contains shell metacharacters, then performing a filebucket request.

Ссылки

http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html
Mailing List
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html
Mailing List
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html
Mailing List
Third Party Advisory
http://projects.puppetlabs.com/issues/13518
Broken Link
Vendor Advisory
http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15
Broken Link
http://puppetlabs.com/security/cve/cve-2012-1988/
Broken Link
Vendor Advisory
http://secunia.com/advisories/48743
Broken Link
Vendor Advisory
http://secunia.com/advisories/48748
Broken Link
Vendor Advisory
http://secunia.com/advisories/48789
Broken Link
Vendor Advisory
http://secunia.com/advisories/49136
Broken Link
Vendor Advisory
http://ubuntu.com/usn/usn-1419-1
Third Party Advisory
http://www.debian.org/security/2012/dsa-2451
Third Party Advisory
http://www.osvdb.org/81309
Broken Link
http://www.securityfocus.com/bid/52975
Broken Link
Third Party Advisory
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/74796
Third Party Advisory
VDB Entry
https://hermes.opensuse.org/messages/14523305
Broken Link
https://hermes.opensuse.org/messages/15087408
Broken Link
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html
Mailing List
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html
Mailing List
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:puppet:puppet:*:*:*:*:*:*:*:*

Версия от 2.6.0 (включая) до 2.6.15 (исключая)

cpe:2.3:a:puppet:puppet:*:*:*:*:*:*:*:*

Версия от 2.7.0 (включая) до 2.7.13 (исключая)

Конфигурация 2

Одно из

cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*

Версия от 1.2.0 (включая) до 2.5.1 (исключая)

cpe:2.3:a:puppet:puppet_enterprise:1.0:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet_enterprise:1.1:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:fedoraproject:fedora:15:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:16:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:17:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*

EPSS

Процентиль: 65%

0.00492

Низкий

6 Medium

CVSS2

Дефекты

CWE-78

Связанные уязвимости

CVE-2012-1988

ubuntu

больше 13 лет назад

CVE-2012-1988

redhat

почти 14 лет назад

CVE-2012-1988

debian

больше 13 лет назад

Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterpr ...

GHSA-6xxq-j39w-g3f6

github

больше 3 лет назад

Puppet Arbitrary Command Execution

BDU:2015-09668

fstec

больше 13 лет назад

Уязвимости операционной системы Gentoo Linux, позволяющие удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации

EPSS

Процентиль: 65%

0.00492

Низкий

6 Medium

CVSS2

Дефекты

CWE-78