Lucene search

K

RubySecRUBY:PUPPET-2013-4761

HistoryOct 23, 2017 - 9:00 p.m.

Puppet `resource_type` Remote Code Execution Vulnerability

2017-10-2321:00:00

RubySec

www.puppet.com

10

CVSS2

5.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and
3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before
2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute
arbitrary Ruby programs from the master via the resource_type
service.

NOTE: this vulnerability can only be exploited using unspecified
“local file system access” to the Puppet Master.

Affected configurations

Vulners

Node

rubypuppetRange2.7.0–2.7.23

OR

rubypuppetRange≤3.2.4

VendorProductVersionCPE
rubypuppet*cpe:2.3:a:ruby:puppet:*:*:*:*:*:*:*:*

References

www.puppet.com/security/cve/cve-2013-4761-resourcetype-remote-code-execution-vulnerability

CVSS2

5.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

Related for RUBY:PUPPET-2013-4761

suse2 nessus12 openvas13 debiancve1 cve1 ubuntucve1 osv2 github1 cvelist1 prion1 nvd1 freebsd1 mageia1 ubuntu1 securityvulns2 amazon1 debian1 redhat2 fedora1 gentoo1