facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability

2017-10-2418:33:36

GitHub Advisory Database

github.com

CVSS2

6.2

Attack Vector

LOCAL

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:H/Au:N/C:C/I:C/A:C

EPSS

Percentile

5.1%

JSON

Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine.

Affected configurations

Vulners

Node

puppetlabsmcollectiveRange<2.5.2

puppetpuppetRange3.0.0–3.6.2

puppetpuppetRange<2.7.26

puppethieraRange<1.3.4

puppetfacterRange2.0.0–2.0.2

puppetfacterRange<1.7.6

VendorProductVersionCPE
puppetlabsmcollective*cpe:2.3:a:puppetlabs:mcollective:*:*:*:*:*:*:*:*
puppetpuppet*cpe:2.3:a:puppet:puppet:*:*:*:*:*:*:*:*
puppethiera*cpe:2.3:a:puppet:hiera:*:*:*:*:*:*:*:*
puppetfacter*cpe:2.3:a:puppet:facter:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
puppetlabs	mcollective	*	cpe:2.3:a:puppetlabs:mcollective::::::::
puppet	puppet	*	cpe:2.3:a:puppet:puppet::::::::
puppet	hiera	*	cpe:2.3:a:puppet:hiera::::::::
puppet	facter	*	cpe:2.3:a:puppet:facter::::::::