Vulnerabilities > CVE-2011-3871 - Permissions, Privileges, and Access Controls vulnerability in multiple products

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-1223-1. The text 
# itself is copyright (C) Canonical, Inc. See 
# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
# trademark of Canonical, Inc.
#

include("compat.inc");

if (description)
{
  script_id(56375);
  script_version("1.9");
  script_cvs_date("Date: 2019/09/19 12:54:27");

  script_cve_id("CVE-2011-3869", "CVE-2011-3870", "CVE-2011-3871");
  script_xref(name:"USN", value:"1223-1");

  script_name(english:"Ubuntu 10.04 LTS / 10.10 / 11.04 : puppet vulnerabilities (USN-1223-1)");
  script_summary(english:"Checks dpkg output for updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Ubuntu host is missing a security-related patch."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"It was discovered that Puppet unsafely opened files when the k5login
type is used to manage files. A local attacker could exploit this to
overwrite arbitrary files which could be used to escalate privileges.
(CVE-2011-3869)

Ricky Zhou discovered that Puppet did not drop privileges when
creating SSH authorized_keys files. A local attacker could exploit
this to overwrite arbitrary files as root. (CVE-2011-3870)

It was discovered that Puppet used a predictable filename when using
the --edit resource. A local attacker could exploit this to edit
arbitrary files or run arbitrary code as the user invoking the
program, typically root. (CVE-2011-3871).

Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://usn.ubuntu.com/1223-1/"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected puppet-common package."
  );
  script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:puppet-common");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:10.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:10.10");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:11.04");

  script_set_attribute(attribute:"vuln_publication_date", value:"2011/10/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2011/09/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2011/10/03");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"Ubuntu Security Notice (C) 2011-2019 Canonical, Inc. / NASL script (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Ubuntu Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("ubuntu.inc");
include("misc_func.inc");

if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/Ubuntu/release");
if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
release = chomp(release);
if (! preg(pattern:"^(10\.04|10\.10|11\.04)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 10.04 / 10.10 / 11.04", "Ubuntu " + release);
if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);

flag = 0;

if (ubuntu_check(osver:"10.04", pkgname:"puppet-common", pkgver:"0.25.4-2ubuntu6.3")) flag++;
if (ubuntu_check(osver:"10.10", pkgname:"puppet-common", pkgver:"2.6.1-0ubuntu2.2")) flag++;
if (ubuntu_check(osver:"11.04", pkgname:"puppet-common", pkgver:"2.6.4-2ubuntu2.3")) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : ubuntu_report_get()
  );
  exit(0);
}
else
{
  tested = ubuntu_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "puppet-common");
}

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Gentoo Linux Security Advisory GLSA 201203-03.
#
# The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc.
# and licensed under the Creative Commons - Attribution / Share Alike 
# license. See http://creativecommons.org/licenses/by-sa/3.0/
#

include("compat.inc");

if (description)
{
  script_id(58213);
  script_version("1.9");
  script_cvs_date("Date: 2018/07/11 17:09:26");

  script_cve_id("CVE-2009-3564", "CVE-2010-0156", "CVE-2011-3848", "CVE-2011-3869", "CVE-2011-3870", "CVE-2011-3871", "CVE-2011-3872", "CVE-2012-1053", "CVE-2012-1054");
  script_bugtraq_id(36628, 38474, 49860, 49909, 50356, 52158);
  script_xref(name:"GLSA", value:"201203-03");

  script_name(english:"GLSA-201203-03 : Puppet: Multiple vulnerabilities");
  script_summary(english:"Checks for updated package(s) in /var/db/pkg");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Gentoo host is missing one or more security-related
patches."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The remote host is affected by the vulnerability described in GLSA-201203-03
(Puppet: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Puppet. Please review
      the CVE identifiers referenced below for details.
  
Impact :

    A local attacker could gain elevated privileges, or access and modify
      arbitrary files.  Furthermore, a remote attacker may be able to spoof a
      Puppet Master or write X.509 Certificate Signing Requests to arbitrary
      locations.
  
Workaround :

    There is no known workaround at this time."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security.gentoo.org/glsa/201203-03"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"All Puppet users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=app-admin/puppet-2.7.11'"
  );
  script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(59, 264);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:puppet");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2012/03/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/03/06");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.");
  script_family(english:"Gentoo Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("qpkg.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (qpkg_check(package:"app-admin/puppet", unaffected:make_list("ge 2.7.11"), vulnerable:make_list("lt 2.7.11"))) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = qpkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Puppet");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory 2011-13633.
#

include("compat.inc");

if (description)
{
  script_id(56516);
  script_version("1.9");
  script_cvs_date("Date: 2019/08/02 13:32:34");

  script_cve_id("CVE-2011-3869", "CVE-2011-3870", "CVE-2011-3871");
  script_xref(name:"FEDORA", value:"2011-13633");

  script_name(english:"Fedora 14 : puppet-2.6.6-3.fc14 (2011-13633)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The following vulnerabilities have been discovered and fixed :

  - CVE-2011-3870, a symlink attack via a user's SSH
    authorized_keys file

    - CVE-2011-3869, a symlink attack via a user's .k5login
      file

    - CVE-2011-3871, a privilege escalation attack via the
      temp file used by the puppet resource application

    - A low-risk file indirector injection attack

Further details can be found in the upstream announcement :

http://groups.google.com/group/puppet-announce/browse_thread/thread/91
e3b46d2328a1cb A vulnerability was discovered in puppet that would
allow an attacker to install a valid X509 Certificate Signing Request
at any location on disk, with the privileges of the Puppet Master
application. For Fedora and EPEL, this is the puppet user.

Further details can be found in the upstream announcement :

http://groups.google.com/group/puppet-users/browse_thread/thread/e57ce
2740feb9406

Unless you enable puppet's listen mode on clients, only the puppet
master is vulnerable to this issue. A vulnerability was discovered in
puppet that would allow an attacker to install a valid X509
Certificate Signing Request at any location on disk, with the
privileges of the Puppet Master application. For Fedora and EPEL, this
is the puppet user.

Further details can be found in the upstream announcement :

http://groups.google.com/group/puppet-users/browse_thread/thread/e57ce
2740feb9406

Unless you enable puppet's listen mode on clients, only the puppet
master is vulnerable to this issue. A vulnerability was discovered in
puppet that would allow an attacker to install a valid X509
Certificate Signing Request at any location on disk, with the
privileges of the Puppet Master application. For Fedora and EPEL, this
is the puppet user.

Further details can be found in the upstream announcement :

http://groups.google.com/group/puppet-users/browse_thread/thread/e57ce
2740feb9406

Unless you enable puppet's listen mode on clients, only the puppet
master is vulnerable to this issue. A vulnerability was discovered in
puppet that would allow an attacker to install a valid X509
Certificate Signing Request at any location on disk, with the
privileges of the Puppet Master application. For Fedora and EPEL, this
is the puppet user.

Further details can be found in the upstream announcement :

http://groups.google.com/group/puppet-users/browse_thread/thread/e57ce
2740feb9406

Unless you enable puppet's listen mode on clients, only the puppet
master is vulnerable to this issue. A vulnerability was discovered in
puppet that would allow an attacker to install a valid X509
Certificate Signing Request at any location on disk, with the
privileges of the Puppet Master application. For Fedora and EPEL, this
is the puppet user.

Further details can be found in the upstream announcement :

http://groups.google.com/group/puppet-users/browse_thread/thread/e57ce
2740feb9406

Unless you enable puppet's listen mode on clients, only the puppet
master is vulnerable to this issue.

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  # http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?56b35af7"
  );
  # http://groups.google.com/group/puppet-users/browse_thread/thread/e57ce2740feb9406
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?5b2f8e47"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?77854d50"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected puppet package."
  );
  script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:puppet");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:14");

  script_set_attribute(attribute:"vuln_publication_date", value:"2011/10/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2011/10/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2011/10/17");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^14([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 14.x", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);

flag = 0;
if (rpm_check(release:"FC14", reference:"puppet-2.6.6-3.fc14")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "puppet");
}