Executive Summary
Summary | |
---|---|
Title | puppet regression update |
Informations | |||
---|---|---|---|
Name | DSA-2831 | First vendor Publication | 2013-12-31 |
Vendor | Debian | Last vendor Modification | 2014-01-17 |
Severity (Vendor) | N/A | Revision | 2 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:L/AC:L/Au:N/C:N/I:P/A:N) | |||
---|---|---|---|
Cvss Base Score | 2.1 | Attack Range | Local |
Cvss Impact Score | 2.9 | Attack Complexity | Low |
Cvss Expoit Score | 3.9 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
The fix for CVE-2013-4969 contained a regression affecting the default file mode if none is specified on a file resource. The oldstable distribution (squeeze) is not affected by this regression. For the stable distribution (wheezy), this problem has been fixed in version 2.7.23-1~deb7u3. For the testing distribution (jessie) and the unstable distribution (sid), this problem has been fixed in version 3.4.2-1. For reference, the original advisory text follows. An unsafe use of temporary files was discovered in Puppet, a tool for centralized configuration management. An attacker can exploit this vulnerability and overwrite an arbitrary file in the system. For the oldstable distribution (squeeze), this problem has been fixed in version 2.6.2-5+squeeze9. For the stable distribution (wheezy), this problem has been fixed in version 2.7.23-1~deb7u2. For the testing distribution (jessie), this problem has been fixed in version 3.4.1-1. For the unstable distribution (sid), this problem has been fixed in version 3.4.1-1. We recommend that you upgrade your puppet packages. |
Original Source
Url : http://www.debian.org/security/2014/dsa-2831 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-59 | Improper Link Resolution Before File Access ('Link Following') |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:21203 | |||
Oval ID: | oval:org.mitre.oval:def:21203 | ||
Title: | DSA-2831-1 puppet - insecure temporary files | ||
Description: | An unsafe use of temporary files was discovered in Puppet, a tool for centralized configuration management. An attacker can exploit this vulnerability and overwrite an arbitrary file in the system. | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-2831-1 CVE-2013-4969 | Version: | 5 |
Platform(s): | Debian GNU/Linux 6.0 Debian GNU/Linux 7 Debian GNU/kFreeBSD 6.0 Debian GNU/kFreeBSD 7 | Product(s): | puppet |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:21386 | |||
Oval ID: | oval:org.mitre.oval:def:21386 | ||
Title: | USN-2077-1 -- puppet vulnerability | ||
Description: | Puppet could be made to overwrite files. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-2077-1 CVE-2013-4969 | Version: | 5 |
Platform(s): | Ubuntu 13.10 Ubuntu 13.04 Ubuntu 12.10 Ubuntu 12.04 | Product(s): | puppet |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:28582 | |||
Oval ID: | oval:org.mitre.oval:def:28582 | ||
Title: | DSA-2831-2 -- puppet -- insecure temporary files | ||
Description: | An unsafe use of temporary files was discovered in Puppet, a tool for centralized configuration management. An attacker can exploit this vulnerability and overwrite an arbitrary file in the system. | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-2831-2 CVE-2013-4969 | Version: | 3 |
Platform(s): | Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 Debian GNU/Linux 7.0 Debian GNU/kFreeBSD 7.0 | Product(s): | puppet |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2014-07-09 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_puppet-140630.nasl - Type : ACT_GATHER_INFO |
2014-03-21 | Name : A web application on the remote host is affected by multiple vulnerabilities. File : puppet_enterprise_311.nasl - Type : ACT_GATHER_INFO |
2014-02-19 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2014-040.nasl - Type : ACT_GATHER_INFO |
2014-02-05 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2014-288.nasl - Type : ACT_GATHER_INFO |
2014-01-27 | Name : A web application on the remote host is potentially affected by a file overwr... File : puppet_cve_2013-4969.nasl - Type : ACT_GATHER_INFO |
2014-01-24 | Name : The remote Fedora host is missing a security update. File : fedora_2014-0825.nasl - Type : ACT_GATHER_INFO |
2014-01-24 | Name : The remote Fedora host is missing a security update. File : fedora_2014-0850.nasl - Type : ACT_GATHER_INFO |
2014-01-07 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2077-1.nasl - Type : ACT_GATHER_INFO |
2014-01-02 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2831.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:32:27 |
|
2014-01-17 17:18:20 |
|
2014-01-08 21:24:13 |
|
2014-01-07 21:24:09 |
|
2013-12-31 21:19:07 |
|