what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 4 of 4 RSS Feed

CVE-2011-3869

Status Candidate

Overview

Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file.

Related Files

Gentoo Linux Security Advisory 201203-03
Posted Mar 7, 2012
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201203-3 - Multiple vulnerabilities have been found in Puppet, the worst of which might allow local attackers to gain escalated privileges. Versions less than 2.7.11 are affected.

tags | advisory, local, vulnerability
systems | linux, gentoo
advisories | CVE-2009-3564, CVE-2010-0156, CVE-2011-3848, CVE-2011-3869, CVE-2011-3870, CVE-2011-3871, CVE-2011-3872, CVE-2012-1053, CVE-2012-1054
SHA-256 | 69813f02a92f89229d9a09aea745f127f1932ebbc0d9430aa9f9838397cd205b
Ubuntu Security Notice USN-1223-2
Posted Oct 6, 2011
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1223-2 - USN-1223-1 fixed vulnerabilities in Puppet. A regression was found on Ubuntu 10.04 LTS that caused permission denied errors when managing SSH authorized_keys files with Puppet. This update fixes the problem. It was discovered that Puppet unsafely opened files when the k5login type is used to manage files. A local attacker could exploit this to overwrite arbitrary files which could be used to escalate privileges. Ricky Zhou discovered that Puppet did not drop privileges when creating SSH authorized_keys files. A local attacker could exploit this to overwrite arbitrary files as root. It was discovered that Puppet used a predictable filename when using the --edit resource. A local attacker could exploit this to edit arbitrary files or run arbitrary code as the user invoking the program, typically root. Various other issues were also addressed.

tags | advisory, arbitrary, local, root, vulnerability
systems | linux, ubuntu
advisories | CVE-2011-3869, CVE-2011-3870, CVE-2011-3871
SHA-256 | 9636d922489ec56ac2e77818db39bf45e099c8cd62d03f34a5778a24ee429245
Debian Security Advisory 2314-1
Posted Oct 3, 2011
Authored by Debian | Site debian.org

Debian Linux Security Advisory 2314-1 - Multiple security issues have been discovered in puppet, a centralized configuration management system.

tags | advisory
systems | linux, debian
advisories | CVE-2011-3848, CVE-2011-3870, CVE-2011-3869, CVE-2011-3871
SHA-256 | 4d61f7d2040b18a2d84536e900279ffbe5494482305020352fafcdf6f331a86b
Ubuntu Security Notice USN-1223-1
Posted Sep 30, 2011
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1223-1 - It was discovered that Puppet unsafely opened files when the k5login type is used to manage files. A local attacker could exploit this to overwrite arbitrary files which could be used to escalate privileges. Ricky Zhou discovered that Puppet did not drop privileges when creating SSH authorized_keys files. A local attacker could exploit this to overwrite arbitrary files as root. It was discovered that Puppet used a predictable filename when using the --edit resource. A local attacker could exploit this to edit arbitrary files or run arbitrary code as the user invoking the program, typically root. Various other issues were also addressed.

tags | advisory, arbitrary, local, root
systems | linux, ubuntu
advisories | CVE-2011-3869, CVE-2011-3870, CVE-2011-3871
SHA-256 | 497e361c82045de9381e8033c477a734
Page 1 of 1
Back1Next

File Archive:

October 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    10 Files
  • 2
    Oct 2nd
    0 Files
  • 3
    Oct 3rd
    0 Files
  • 4
    Oct 4th
    0 Files
  • 5
    Oct 5th
    0 Files
  • 6
    Oct 6th
    0 Files
  • 7
    Oct 7th
    0 Files
  • 8
    Oct 8th
    0 Files
  • 9
    Oct 9th
    0 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    0 Files
  • 12
    Oct 12th
    0 Files
  • 13
    Oct 13th
    0 Files
  • 14
    Oct 14th
    0 Files
  • 15
    Oct 15th
    0 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close