ID de Prueba:	1.3.6.1.4.1.25623.1.0.120414
Categoría:	Amazon Linux Local Security Checks
Título:	Amazon Linux: Security Advisory (ALAS-2012-53)
Resumen:	The remote host is missing an update for the 'puppet' package(s) announced via the ALAS-2012-53 advisory.
Descripción:	Summary: The remote host is missing an update for the 'puppet' package(s) announced via the ALAS-2012-53 advisory. Vulnerability Insight: Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a user login file with the k5login resource type, allows local users to gain privileges via a symlink attack on .k5login. The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors related to (1) the change_user not dropping supplementary groups in certain conditions, (2) changes to the eguid without associated changes to the egid, or (3) the addition of the real gid to supplementary groups. Affected Software/OS: 'puppet' package(s) on Amazon Linux. Solution: Please install the updated package(s). CVSS Score: 6.9 CVSS Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2012-1053 BugTraq ID: 52158 http://www.securityfocus.com/bid/52158 Debian Security Information: DSA-2419 (Google Search) http://www.debian.org/security/2012/dsa-2419 http://projects.puppetlabs.com/issues/12457 http://projects.puppetlabs.com/issues/12458 http://projects.puppetlabs.com/issues/12459 http://www.osvdb.org/79495 http://secunia.com/advisories/48157 http://secunia.com/advisories/48161 http://secunia.com/advisories/48166 http://secunia.com/advisories/48290 SuSE Security Announcement: SUSE-SU-2012:0325 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html SuSE Security Announcement: openSUSE-SU-2012:0835 (Google Search) https://hermes.opensuse.org/messages/15087408 http://ubuntu.com/usn/usn-1372-1 XForce ISS Database: puppet-forked-priv-escalation(73445) https://exchange.xforce.ibmcloud.com/vulnerabilities/73445 Common Vulnerability Exposure (CVE) ID: CVE-2012-1054 http://projects.puppetlabs.com/issues/12460 http://www.osvdb.org/79496 XForce ISS Database: puppet-k5login-type-symlink(73446) https://exchange.xforce.ibmcloud.com/vulnerabilities/73446
Copyright	Copyright (C) 2015 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.