製品・ソフトウェアに関する情報

JVN脆弱性詳細

Puppet および Puppet Enterprise におけるディレクトリトラバーサルの脆弱性

Title	Puppet および Puppet Enterprise におけるディレクトリトラバーサルの脆弱性
Summary	Puppet および Puppet Enterprise の lib/puppet/reports/store.rb には、auth.conf 内の Delete が有効である場合、ディレクトリトラバーサルの脆弱性が存在します。
Possible impacts	リモート認証されたユーザにより、.. (ドットドット) を含むノード名を介して、Puppet マスターサーバ上の任意のファイルを削除される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Aug. 6, 2012, midnight
Registration Date	Aug. 9, 2012, 11:45 a.m.
Last Update	Sept. 14, 2012, 4:01 p.m.

Affected System

Puppet

Puppet 2.6.17 未満

Puppet 2.7.18 未満の 2.7.x

Puppet Enterprise 2.5.2 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2012-3865	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3865
National Vulnerability Database (NVD)
2	CVE-2012-3865	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3865
Puppet
3	CVE-2012-3865	http://puppetlabs.com/security/cve/cve-2012-3865/

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-22	https://jvndb.jvn.jp/ja/cwe/CWE-22.html

ベンダー情報

No	Name	URL
Debian Security Advisory
1	DSA-2511	http://www.debian.org/security/2012/dsa-2511
GitHub
2	Reject directory traversal in store report processor - 554eefc	https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f
3	Reject directory traversal in store report processor - d804782	https://github.com/puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6
opensuse-security-announce
4	SUSE-SU-2012:0983	http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html
Red Hat Bugzilla
5	Bug 839131	https://bugzilla.redhat.com/show_bug.cgi?id=839131
Ubuntu Security Notice
6	USN-1506-1	http://www.ubuntu.com/usn/USN-1506-1/

Change Log

No	Changed Details	Date of change
0	[2012年08月09日] 掲載 [2012年09月14日] ベンダ情報：Ubuntu (USN-1506-1) を追加ベンダ情報：Debian (DSA-2511) を追加ベンダ情報：openSUSE (SUSE-SU-2012:0983) を追加	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2012-3865

Summary	Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.
Publication Date	Aug. 7, 2012, 1:55 a.m.
Registration Date	Jan. 28, 2021, 3:01 p.m.
Last Update	Nov. 21, 2024, 10:41 a.m.

Affected software configurations

Configuration3		or higher	or less	more than	less than
cpe:2.3:a:puppet:puppet_enterprise::::::::			2.5.1

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html
2	http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html
3	http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html
4	http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html
5	http://puppetlabs.com/security/cve/cve-2012-3865/	Vendor Advisory
6	http://puppetlabs.com/security/cve/cve-2012-3865/	Vendor Advisory
7	http://secunia.com/advisories/50014
8	http://secunia.com/advisories/50014
9	http://www.debian.org/security/2012/dsa-2511
10	http://www.debian.org/security/2012/dsa-2511
11	http://www.ubuntu.com/usn/USN-1506-1
12	http://www.ubuntu.com/usn/USN-1506-1
13	https://bugzilla.redhat.com/show_bug.cgi?id=839131
14	https://bugzilla.redhat.com/show_bug.cgi?id=839131
15	https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f	Exploit Patch
16	https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f	Exploit Patch
17	https://github.com/puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6	Exploit Patch
18	https://github.com/puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6	Exploit Patch

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-22	パス・トラバーサル	https://cwe.mitre.org/data/definitions/22.html