PT-2013-1234

Name of the Vulnerable Software and Affected Versions Puppet versions 2.7.x through 2.7.22 Puppet versions 3.2.x through 3.2.3 Puppet Enterprise versions 2.8.x through 2.8.2 Puppet Enterprise versions 3.0.x through 3.0.0 Description The issue allows remote attackers to execute arbitrary Ruby...

PT-2013-5303

Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions prior to 3.0.1 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the service parameter. This can be exploited by including a malicious UR...

PT-2013-5306

Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions prior to 3.0.1 Description The issue allows local users to potentially obtain sensitive information, including host name, MAC address, and SSH keys, via the web browser cache due to HTTP responses not having the...

PT-2013-5305

Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions prior to 3.0.1 Description The issue makes it easier for attackers to gain privileges by leveraging an unattended workstation, as there is no session timeout. Recommendations For versions prior to 3.0.1, update to...

PT-2013-5307

Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions prior to 3.0.1 Description The issue allows remote attackers to obtain sensitive information about the Apache and Phusion Passenger products due to version information being included in HTTP response headers...

PT-2013-5179

Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions prior to 3.0.1 Description The issue arises from insufficient session invalidation when a user logs out, potentially allowing remote attackers to hijack sessions by obtaining an old session ID. Recommendations For...

PT-2013-5311

Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions prior to 3.0.1 Description The issue allows remote attackers to obtain the database password due to how the password is seeded as a console parameter, related to External Node Classifiers, and the lack of access...

CVE-2013-4959: Exposure of Sensitive Information to an Unauthorized Actor

Puppet Enterprise before 3.0.1 uses HTTP responses that contain sensitive information without the "no-cache" setting, which might allow local users to obtain sensitive information such as 1 host name, 2 MAC address, and 3 SSH keys via the web browser cache...

CVE-2013-4958: Improper Authentication

Puppet Enterprise before 3.0.1 does not use a session timeout, which makes it easier for attackers to gain privileges by leveraging an unattended workstation...

CVE-2013-4961: Exposure of Sensitive Information to an Unauthorized Actor

Puppet Enterprise before 3.0.1 includes version information for the Apache and Phusion Passenger products in its HTTP response headers, which allows remote attackers to obtain sensitive information...

CVE-2013-4955: Improper Input Validation

Open redirect vulnerability in the login page in Puppet Enterprise before 3.0.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the service parameter...

CVE-2013-4761: Undefined Security Weakness

Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resourcetype service. NOTE: this vulnerability can only be exploited...

CVE-2013-4956: Undefined Security Weakness

Puppet Module Tool PMT, as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, installs modules with weak permissions if those permissions were used when the modules were originally built, which might allow local users to rea...

CVE-2013-4962: Undefined Security Weakness

The reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current password, which allows attackers to modify user passwords by leveraging session hijacking, an unattended workstation, or other vectors...

CVE-2013-4967: Undefined Security Weakness

Puppet Enterprise before 3.0.1 allows remote attackers to obtain the database password via vectors related to how the password is "seeded as a console parameter," External Node Classifiers, and the lack of access control for /nodes...

CVE-2013-4762: Improper Input Validation

Puppet Enterprise before 3.0.1 does not sufficiently invalidate a session when a user logs out, which might allow remote attackers to hijack sessions by obtaining an old session ID...

CVE-2013-4964: Undefined Security Weakness

Puppet Enterprise before 3.0.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

FreeBSD : puppet -- multiple vulnerabilities (2b2f6092-0694-11e3-9e8e-000c29f6ae42)

Puppet Labs reports : By using the resourcetype service, an attacker could cause puppet to load arbitrary Ruby files from the puppet master node's file system. While this behavior is not enabled by default, auth.conf settings could be modified to allow it. The exploit requires local file system...

PT-2013-5308

Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions prior to 3.0.1 Description The issue concerns the reset password page, which does not require the current password to be entered. This allows attackers to change user passwords by exploiting session hijacking,...

PT-2013-5309

Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions prior to 3.0.1 Description The issue allows remote attackers to capture the session cookie by intercepting its transmission within an http session, as the secure flag for the session cookie in an https session is not...