Test ID:	1.3.6.1.4.1.25623.1.0.840907
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-1372-1)
Summary:	The remote host is missing an update for the 'puppet' package(s) announced via the USN-1372-1 advisory.
Description:	Summary: The remote host is missing an update for the 'puppet' package(s) announced via the USN-1372-1 advisory. Vulnerability Insight: It was discovered that Puppet did not drop privileges when executing commands as different users. If an attacker had control of the execution manifests or the executed command, this could be used to execute code with elevated group permissions (typically root). (CVE-2012-1053) It was discovered that Puppet unsafely opened files when the k5login type is used to manage files. A local attacker could exploit this to overwrite arbitrary files and escalate privileges. (CVE-2012-1054) Affected Software/OS: 'puppet' package(s) on Ubuntu 10.04, Ubuntu 10.10, Ubuntu 11.04, Ubuntu 11.10. Solution: Please install the updated package(s). CVSS Score: 6.9 CVSS Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2012-1053 BugTraq ID: 52158 http://www.securityfocus.com/bid/52158 Debian Security Information: DSA-2419 (Google Search) http://www.debian.org/security/2012/dsa-2419 http://projects.puppetlabs.com/issues/12457 http://projects.puppetlabs.com/issues/12458 http://projects.puppetlabs.com/issues/12459 http://www.osvdb.org/79495 http://secunia.com/advisories/48157 http://secunia.com/advisories/48161 http://secunia.com/advisories/48166 http://secunia.com/advisories/48290 SuSE Security Announcement: SUSE-SU-2012:0325 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html SuSE Security Announcement: openSUSE-SU-2012:0835 (Google Search) https://hermes.opensuse.org/messages/15087408 http://ubuntu.com/usn/usn-1372-1 XForce ISS Database: puppet-forked-priv-escalation(73445) https://exchange.xforce.ibmcloud.com/vulnerabilities/73445 Common Vulnerability Exposure (CVE) ID: CVE-2012-1054 http://projects.puppetlabs.com/issues/12460 http://www.osvdb.org/79496 XForce ISS Database: puppet-k5login-type-symlink(73446) https://exchange.xforce.ibmcloud.com/vulnerabilities/73446
Copyright	Copyright (C) 2012 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.