Announce: Puppet 2.7.13 Available [security release]

Matthaus Litteken
Wed, 11 Apr 2012 01:08:44 -0000

Puppet 2.7.13 is a security release in the 2.7.x branch.

The security changes in 2.7.13 address CVEs 2012-1906, 2012-1986,
2012-1987, 2012-1988, and 2012-1989.

All users of Puppet 2.7.x are encouraged to upgrade when possible to
Puppet 2.7.13.

More information available at:  http://puppetlabs.com/security
or visit http://puppetlabs.com/security/cve/cve-2012-1906,
http://puppetlabs.com/security/cve/cve-2012-1986,
http://puppetlabs.com/security/cve/cve-2012-1987,
http://puppetlabs.com/security/cve/cve-2012-1988, and
http://puppetlabs.com/security/cve/cve-2012-1989

Detailed feature release notes are available:

https://projects.puppetlabs.com/projects/puppet/wiki/Release_Notes#2.7.13


This release is available for download at:
http://puppetlabs.com/downloads/puppet/puppet-2.7.13.tar.gz

RPM''s are available at http://yum.puppetlabs.com/el or /fedora

Debs are available on http://apt.puppetlabs.com (lenny requires
backports enabled)

Windows packages are available at
http://downloads.puppetlabs.com/windows/puppet-2.7.13.msi

Mac packages are available at
http://downloads.puppetlabs.com/mac/puppet-2.7.13.dmg

Puppet is also available via Rubygems at http://rubygems.org

See the Verifying Puppet Download section at:
http://projects.puppetlabs.com/projects/puppet/wiki/Downloading_Puppet

Please report feedback via the Puppet Labs Redmine site, using an
affected puppet version of 2.7.13
http://projects.puppetlabs.com/projects/puppet/


# Summary #

CVE-2012-1906 (High) [#13260] - appdmg and pkgdmg providers write
packages to insecure location
 If a remote source is given for a package, the package is downloaded
to a predictable filename in /tmp.
 It is possible to create a symlink at this name and use it to
clobber any file on the system, or by switching
 the symlink install arbitrary packages (and package installers can
execute arbitrary code).

CVE-2012-1986 (High) [#13511] - Filebucket arbitrary file read
 It is possible to construct a REST request to fetch a file from a
filebucket that overrides the puppet master’s
 defined location for the files to be stored. If a user has access to
construct directories and symlinks on the
 machine they can read any file that the user the puppet master is
running as has access to.

CVE-2012-1987 (Moderate) [#13552,#13553] - Filebucket denial of service
 By constructing a marshaled form of a Puppet::FileBucket::File
object a user can cause it it to be written to
 any place on the disk of the puppet master. This could be used for a
denial of service attach against the puppet
 master if an attacker fills a filesystem that can cause systems to
stop working. In order to do this the attacker
 needs no access to the puppet master system, but does need access to
agent SSL keys.

 Using the symlink attack described in Bug #13511 the puppet master
can be caused to read from a stream
 (e.g. /dev/random) when either trying to save a file or read a file.
Because of the way in which the puppet master
 deals with sending files on the filesystem to a remote system via a
REST request the thread handling the request
 will block forever reading from that stream and continually
consuming more memory. This can lead to the puppet
 master system running out of memory and cause a denial of service.

CVE-2012-1988 (High) [#13518] - Filebucket arbitrary code execution
 This requires access to the cert on the agent and an unprivileged
account on the master.  By creating a path on
 the master in a world-writable location that matches a command
string, one can then make a file bucket request
 to execute that command.

CVE-2012-1989 (High) [#13606] - Telnet utility (used for network
devices) writes to insecure location
 The telnet.rb file opens a NET::Telnet connection with an output log
of /tmp/out.log. That log could be replaced
 by a symlink anywhere on the system and the puppet user would
happily write through the symlink, potentially
 clobbering data or worse.


 2.7.13 Changelog
 ============ * 1f58ea6 Stub mktmpdir and remove_entry_secure in os x package
providers
 * b7553a5 (#13260) Spec test to verify that mktmpdir is used
 * 46e8dc0 (#13260) Use mktmpdir when downloading packages
 * b36bda9 Refactor pkgdmg specs
 * 91e7ce4 Remove telnet Output_log parameter
 * 0d6d299 Fix for bucket_path security vulnerability
 * 19bd30a Removed text/marshal support

--
You received this message because you are subscribed to the Google Groups
"Puppet Developers" group.
To post to this group, send email to puppet-dev@googlegroups.com.
To unsubscribe from this group, send email to
puppet-dev+unsubscribe@googlegroups.com.
For more options, visit this group at