Test ID:	1.3.6.1.4.1.25623.1.0.71609
Category:	Ubuntu Local Security Checks
Title:	Ubuntu USN-1506-1 (puppet-common)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to puppet-common announced via advisory USN-1506-1. Details: It was discovered that Puppet incorrectly handled certain HTTP GET requests. An attacker could use this flaw with a valid client certificate to retrieve arbitrary files from the Puppet master. (CVE-2012-3864) It was discovered that Puppet incorrectly handled Delete requests. If a Puppet master were reconfigured to allow the Delete method, an attacker on an authenticated host could use this flaw to delete arbitrary files from the Puppet server, leading to a denial of service. (CVE-2012-3865) It was discovered that Puppet incorrectly set file permissions on the last_run_report.yaml file. An attacker could use this flaw to access sensitive information. This issue only affected Ubuntu 11.10 and Ubuntu 12.04 LTS. (CVE-2012-3866) It was discovered that Puppet incorrectly handled agent certificate names. An attacker could use this flaw to create a specially crafted certificate and trick an administrator into signing a certificate that can then be used to man-in-the-middle agent nodes. (CVE-2012-3867) Solution: The problem can be corrected by updating your system to the following package versions: Ubuntu 11.10: puppet-common 2.7.1-1ubuntu3.7 Ubuntu 11.04: puppet-common 2.6.4-2ubuntu2.10 Ubuntu 10.04 LTS: puppet-common 0.25.4-2ubuntu6.8 http://www.securityspace.com/smysecure/catid.html?in=USN-1506-1 CVSS Score: 4.3 CVSS Vector: AV:L/AC:H/Au:NR/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2012-3864 Debian Security Information: DSA-2511 (Google Search) http://www.debian.org/security/2012/dsa-2511 http://secunia.com/advisories/50014 SuSE Security Announcement: SUSE-SU-2012:0983 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html SuSE Security Announcement: openSUSE-SU-2012:0891 (Google Search) http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html http://www.ubuntu.com/usn/USN-1506-1 Common Vulnerability Exposure (CVE) ID: CVE-2012-3865 Common Vulnerability Exposure (CVE) ID: CVE-2012-3866 Common Vulnerability Exposure (CVE) ID: CVE-2012-3867
Copyright	Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.