Test ID:	1.3.6.1.4.1.25623.1.0.71255
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-2451-1)
Summary:	The remote host is missing an update for the Debian 'puppet' package(s) announced via the DSA-2451-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'puppet' package(s) announced via the DSA-2451-1 advisory. Vulnerability Insight: Several vulnerabilities have been discovered in Puppet, a centralized configuration management system. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2012-1906 Puppet is using predictable temporary file names when downloading Mac OS X package files. This allows a local attacker to either overwrite arbitrary files on the system or to install an arbitrary package. CVE-2012-1986 When handling requests for a file from a remote filebucket, Puppet can be tricked into overwriting its defined location for filebucket storage. This allows an authorized attacker with access to the Puppet master to read arbitrary files. CVE-2012-1987 Puppet is incorrectly handling filebucket store requests. This allows an attacker to perform denial of service attacks against Puppet by resource exhaustion. CVE-2012-1988 Puppet is incorrectly handling filebucket requests. This allows an attacker with access to the certificate on the agent and an unprivileged account on Puppet master to execute arbitrary code via crafted file path names and making a filebucket request. For the stable distribution (squeeze), this problem has been fixed in version 2.6.2-5+squeeze5. For the testing distribution (wheezy), this problem has been fixed in version 2.7.13-1. For the unstable distribution (sid), this problem has been fixed in version 2.7.13-1. We recommend that you upgrade your puppet packages. Affected Software/OS: 'puppet' package(s) on Debian 6. Solution: Please install the updated package(s). CVSS Score: 6.0 CVSS Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2012-1906 BugTraq ID: 52975 http://www.securityfocus.com/bid/52975 Debian Security Information: DSA-2451 (Google Search) http://www.debian.org/security/2012/dsa-2451 http://projects.puppetlabs.com/issues/13260 http://secunia.com/advisories/48743 http://secunia.com/advisories/48748 http://secunia.com/advisories/48789 http://ubuntu.com/usn/usn-1419-1 XForce ISS Database: puppet-macosx-symlink(74793) https://exchange.xforce.ibmcloud.com/vulnerabilities/74793 Common Vulnerability Exposure (CVE) ID: CVE-2012-1986 http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html http://projects.puppetlabs.com/issues/13511 http://secunia.com/advisories/49136 SuSE Security Announcement: openSUSE-SU-2012:0608 (Google Search) https://hermes.opensuse.org/messages/14523305 SuSE Security Announcement: openSUSE-SU-2012:0835 (Google Search) https://hermes.opensuse.org/messages/15087408 XForce ISS Database: puppet-rest-symlink(74794) https://exchange.xforce.ibmcloud.com/vulnerabilities/74794 Common Vulnerability Exposure (CVE) ID: CVE-2012-1987 http://projects.puppetlabs.com/issues/13552 http://projects.puppetlabs.com/issues/13553 http://www.osvdb.org/81308 XForce ISS Database: puppet-rest-dos(74795) Common Vulnerability Exposure (CVE) ID: CVE-2012-1988 http://projects.puppetlabs.com/issues/13518 http://www.osvdb.org/81309 XForce ISS Database: puppet-file-bucket-command-exec(74796) https://exchange.xforce.ibmcloud.com/vulnerabilities/74796
Copyright	Copyright (C) 2012 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.