Actu
Vigil@nce - Puppet Enterprise: multiple vulnerabilities
March 2014 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can use several vulnerabilities of Puppet Enterprise.
Impacted products: Puppet
Severity: 2/4
Creation date: 04/03/2014
DESCRIPTION OF THE VULNERABILITY
Several vulnerabilities were announced in Puppet Enterprise.
An attacker can spoof the Console, in order to escalate his
privileges. [severity:2/4; BID-65992, CVE-2013-4966]
An attacker can access to the Node Endpoint, in order to obtain
sensitive information. [severity:2/4; BID-65993, CVE-2013-4971]
An attacker who gained a role via SET ROLE in PostgreSQL, can
revoke the access of other members (VIGILANCE-VUL-14289
(https://vigilance.fr/tree/1/14289?w=66901)). [severity:2/4;
BID-65723, CERTFR-2014-AVI-080, CVE-2014-0060]
An attacker can use ActionView, in order to trigger a denial of
service. [severity:2/4; CVE-2014-0082]
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/Puppet-Enterprise-multiple-vulnerabilities-14361
