Test ID:	1.3.6.1.4.1.25623.1.0.120145
Category:	Amazon Linux Local Security Checks
Title:	Amazon Linux: Security Advisory (ALAS-2012-75)
Summary:	The remote host is missing an update for the 'puppet' package(s) announced via the ALAS-2012-75 advisory.
Description:	Summary: The remote host is missing an update for the 'puppet' package(s) announced via the ALAS-2012-75 advisory. Vulnerability Insight: Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with an authorized SSL key and certain permissions on the puppet master to read arbitrary files via a symlink attack in conjunction with a crafted REST request for a file in a filebucket. Affected Software/OS: 'puppet' package(s) on Amazon Linux. Solution: Please install the updated package(s). CVSS Score: 2.1 CVSS Vector: AV:N/AC:H/Au:S/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2012-1986 BugTraq ID: 52975 http://www.securityfocus.com/bid/52975 Debian Security Information: DSA-2451 (Google Search) http://www.debian.org/security/2012/dsa-2451 http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html http://projects.puppetlabs.com/issues/13511 http://secunia.com/advisories/48743 http://secunia.com/advisories/48748 http://secunia.com/advisories/48789 http://secunia.com/advisories/49136 SuSE Security Announcement: openSUSE-SU-2012:0608 (Google Search) https://hermes.opensuse.org/messages/14523305 SuSE Security Announcement: openSUSE-SU-2012:0835 (Google Search) https://hermes.opensuse.org/messages/15087408 http://ubuntu.com/usn/usn-1419-1 XForce ISS Database: puppet-rest-symlink(74794) https://exchange.xforce.ibmcloud.com/vulnerabilities/74794
Copyright	Copyright (C) 2015 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.