all things security

Debian Security Advisory 2831-2

Debian Security Advisory 2831-2
Posted Jan 17, 2014
Authored by Debian | Site debian.org

Debian Linux Security Advisory 2831-2 - The fix for puppet that addressed CVE-2013-4969 contained a regression affecting the default file mode if none is specified on a file resource.

tags | advisory
systems | linux, debian
advisories | CVE-2013-4969
MD5 | 7fd38c9e8b2aaf93d88e112deff7daab

Debian Security Advisory 2831-2

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2831-2 security@debian.org
http://www.debian.org/security/ Salvatore Bonaccorso
January 17, 2014 http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : puppet
Vulnerability : regression
Debian-specific: no
Debian Bug : 734444

The fix for CVE-2013-4969 contained a regression affecting the default
file mode if none is specified on a file resource.

The oldstable distribution (squeeze) is not affected by this regression.

For the stable distribution (wheezy), this problem has been fixed in
version 2.7.23-1~deb7u3.

For the testing distribution (jessie) and the unstable distribution
(sid), this problem has been fixed in version 3.4.2-1.

For reference, the original advisory text follows.

An unsafe use of temporary files was discovered in Puppet, a tool for
centralized configuration management. An attacker can exploit this
vulnerability and overwrite an arbitrary file in the system.

For the oldstable distribution (squeeze), this problem has been fixed in
version 2.6.2-5+squeeze9.

For the stable distribution (wheezy), this problem has been fixed in
version 2.7.23-1~deb7u2.

For the testing distribution (jessie), this problem has been fixed in
version 3.4.1-1.

For the unstable distribution (sid), this problem has been fixed in
version 3.4.1-1.

We recommend that you upgrade your puppet packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJS2VDIAAoJEAVMuPMTQ89EJDIP/3s1z5/F0jY78IgzvH4smp9z
XJp7zWClZgRbHP8OdRPaEFd5EGVfaWR+Utvp0c68fY5dqKsTWGePg8E8PayDYItx
9yABFBfTlorbThWSbd9wLJ4XazcdsAzA4GvFB5VqVoy0DuqMq9un96+F+D/wlngN
awnBSJCt+BDEoKrUee6YMVqeHFlMITdC/kYbs+ZkuaQ21YBhO31En27jtE69DrHU
HWq5rCywN+0IDpbkJ5RLkGRlya1pGW+j1pSXLyj5tGsOSclZzItkbvoJb0053VnG
fDc1Q920ZRplOn3GXvyFkdjLEbTg2JcSVn5veIX1OTZ7KwT0Bp6n+iyqa3j9FdtG
fhY78b92Eba7K3hWHhddN72K4mXY0y5W4DDOoK1HLWWo1oq8g+pUSHhSj/WVfFkv
xEgJRSb2bsiEiwkMjAWwQGUjuhpna1/nQIiwKayL6EPcjuIa6k0mdgr9+DnHUEZJ
Rb1WWyjaRs/15/6Jxcx7BsOy/EpgSq1mvwsLI8nZE4DSHSBj+BGnDojJ3iLXTSL2
yvxZTLa2iCm/+CsLMQTVRvJylxE4Sn7aelOpGPrfdFUBI9YpTmgcDJ7gQ8qcr7Tx
Zi4efYc4j89t87U9APIS1uNxSarEULYsNF8V31JDqWR1N6Y65viaH6Hrp9Le3eqr
XlcH6Q25UYFJG/57YG1M
=aCWc
-----END PGP SIGNATURE-----


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    2 Files
  • 2
    Jul 2nd
    3 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    4 Files
  • 5
    Jul 5th
    15 Files
  • 6
    Jul 6th
    15 Files
  • 7
    Jul 7th
    10 Files
  • 8
    Jul 8th
    2 Files
  • 9
    Jul 9th
    10 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    15 Files
  • 12
    Jul 12th
    19 Files
  • 13
    Jul 13th
    16 Files
  • 14
    Jul 14th
    15 Files
  • 15
    Jul 15th
    3 Files
  • 16
    Jul 16th
    2 Files
  • 17
    Jul 17th
    8 Files
  • 18
    Jul 18th
    11 Files
  • 19
    Jul 19th
    15 Files
  • 20
    Jul 20th
    11 Files
  • 21
    Jul 21st
    4 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close