製品・ソフトウェアに関する情報

JVN脆弱性詳細

Puppet および Puppet Enterprise Users における Puppet master になりすまされる脆弱性

Title	Puppet および Puppet Enterprise Users における Puppet master になりすまされる脆弱性
Summary	Puppet Labs の Puppet および Puppet Enterprise Users は、エージェントの証明書に署名する際、証明書の X.509 Subject Alternative Name フィールドに、Puppet master の certdnsnames 値を追加するため、Puppet master になりすまされる脆弱性が存在します。
Possible impacts	第三者により、master の代替 DNS の名前を使用するエージェントに対する中間者攻撃 (MITM) を介して、Puppet master になりすまされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Oct. 24, 2011, midnight
Registration Date	Nov. 4, 2011, 3:03 p.m.
Last Update	Nov. 4, 2011, 3:03 p.m.

Affected System

Puppet

Puppet 2.6.12 未満の 2.6.x

Puppet 2.7.6 未満の 2.7.x

Puppet Enterprise Users 1.0

Puppet Enterprise Users 1.1

Puppet Enterprise Users 1.2.4 未満の 1.2

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2011-3872	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3872
National Vulnerability Database (NVD)
2	CVE-2011-3872	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3872

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
Puppet
1	Index of /puppet	http://downloads.puppetlabs.com/puppet
2	Puppet Labs Hot Fixes	http://puppetlabs.com/security/hotfixes
Puppet Blog
3	Important Security Announcement: AltNames Vulnerability	http://puppetlabs.com/blog/important-security-announcement-altnames-vulnerability/

Change Log

No	Changed Details	Date of change
0	[2011年11月04日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2011-3872

Summary	Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof a Puppet master via a man-in-the-middle (MITM) attack against an agent that uses an alternate DNS name for the master, aka "AltNames Vulnerability."
Publication Date	Oct. 28, 2011, 5:55 a.m.
Registration Date	Jan. 28, 2021, 4:39 p.m.
Last Update	Nov. 21, 2024, 10:31 a.m.

Affected software configurations

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:puppetlabs:puppet_enterprise_users:1.0:::::::*
cpe:2.3:a:puppetlabs:puppet_enterprise_users:1.1:::::::*
cpe:2.3:a:puppet:puppet_enterprise:1.2.0:::::::*
cpe:2.3:a:puppet:puppet_enterprise:1.2.1:::::::*
cpe:2.3:a:puppet:puppet_enterprise:1.2.2:::::::*
cpe:2.3:a:puppet:puppet_enterprise:1.2.3:::::::*

Related information, measures and tools

No	URL	タグ
1	http://groups.google.com/group/puppet-announce/browse_thread/thread/e7edc3a71348f3e1	Patch
2	http://puppetlabs.com/blog/important-security-announcement-altnames-vulnerability/
3	http://secunia.com/advisories/46550	Vendor Advisory
4	http://secunia.com/advisories/46578	Vendor Advisory
5	http://secunia.com/advisories/46934
6	http://secunia.com/advisories/46964
7	http://www.securityfocus.com/bid/50356
8	http://www.ubuntu.com/usn/USN-1238-1
9	http://www.ubuntu.com/usn/USN-1238-2
10	https://exchange.xforce.ibmcloud.com/vulnerabilities/70970
11	https://puppet.com/security/cve/cve-2011-3872
12	http://groups.google.com/group/puppet-announce/browse_thread/thread/e7edc3a71348f3e1	Patch
13	https://puppet.com/security/cve/cve-2011-3872
14	https://exchange.xforce.ibmcloud.com/vulnerabilities/70970
15	http://www.ubuntu.com/usn/USN-1238-2
16	http://www.ubuntu.com/usn/USN-1238-1
17	http://www.securityfocus.com/bid/50356
18	http://secunia.com/advisories/46964
19	http://secunia.com/advisories/46934
20	http://secunia.com/advisories/46578	Vendor Advisory
21	http://secunia.com/advisories/46550	Vendor Advisory
22	http://puppetlabs.com/blog/important-security-announcement-altnames-vulnerability/

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:puppetlabs:puppet_enterprise_users:1.0:::::::*
cpe:2.3:a:puppetlabs:puppet_enterprise_users:1.1:::::::*
cpe:2.3:a:puppet:puppet_enterprise:1.2.0:::::::*
cpe:2.3:a:puppet:puppet_enterprise:1.2.1:::::::*
cpe:2.3:a:puppet:puppet_enterprise:1.2.2:::::::*
cpe:2.3:a:puppet:puppet_enterprise:1.2.3:::::::*