Bug 810071 - (CVE-2012-1988) CVE-2012-1988 puppet: Filebucket arbitrary code execution
CVE-2012-1988 puppet: Filebucket arbitrary code execution
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20120410,repor...
: Security
Depends On: 811820 811821 812955 812956 834391
Blocks: 810072 836071
  Show dependency treegraph
 
Reported: 2012-04-05 00:06 EDT by Kurt Seifried
Modified: 2013-01-02 06:34 EST (History)
3 users (show)

See Also:
Fixed In Version: puppet 2.6.15, puppet 2.7.13
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-12-11 04:26:12 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Kurt Seifried 2012-04-05 00:06:28 EDT
From Matthaus Litteken <matthaus@puppetlabs.com>:

CVE-2012-1988 (High) [#13518] - Filebucket arbitrary code execution
This requires access to the cert on the agent and an unprivileged 
account on the master. By creating a path on the master in a 
world-writable location that matches a command string, one can 
then make a file bucket request to execute that command.
Comment 3 Vincent Danen 2012-04-16 12:27:08 EDT
This is public now.

External Reference:

http://puppetlabs.com/security/cve/cve-2012-1988/
Comment 4 Vincent Danen 2012-04-16 12:33:17 EDT
Created puppet tracking bugs for this issue

Affects: fedora-all [bug 812955]
Affects: epel-all [bug 812956]
Comment 5 Murray McAllister 2012-04-19 01:14:50 EDT
Acknowledgements:

Red Hat would like to thank Puppet Labs for reporting this issue.
Comment 6 Fedora Update System 2012-04-27 01:51:15 EDT
puppet-2.6.16-1.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 7 Fedora Update System 2012-04-27 02:05:22 EDT
puppet-2.6.16-1.fc15 has been pushed to the Fedora 15 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 8 Fedora Update System 2012-05-02 16:32:51 EDT
puppet-2.6.16-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 9 Fedora Update System 2012-05-02 16:33:36 EDT
puppet-2.6.16-1.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 10 Fedora Update System 2012-05-06 00:52:42 EDT
puppet-2.7.13-1.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 12 errata-xmlrpc 2012-12-04 14:31:01 EST
This issue has been addressed in following products:

  CloudForms for RHEL 6

Via RHSA-2012:1542 https://rhn.redhat.com/errata/RHSA-2012-1542.html

Note You need to log in before you can comment on or make changes to this bug.