Vulnerabilities > CVE-2018-6508 - Use of Externally-Controlled Format String vulnerability in Puppet Enterprise 2017.3.0/2017.3.1/2017.3.2
Attack vector
NETWORK Attack complexity
LOW Privileges required
LOW Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the facter_task or puppet_conf tasks. This vulnerability only affects tasks in the affected modules, if you are not using puppet tasks you are not affected by this vulnerability.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 3 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Format String Injection An attacker includes formatting characters in a string input field on the target application. Most applications assume that users will provide static text and may respond unpredictably to the presence of formatting character. For example, in certain functions of the C programming languages such as printf, the formatting character %s will print the contents of a memory location expecting this location to identify a string and the formatting character %n prints the number of DWORD written in the memory. An attacker can use this to read or write to memory locations or files, or simply to manipulate the value of the resulting text in unexpected ways. Reading or writing memory may result in program crashes and writing memory could result in the execution of arbitrary code if the attacker can write to the program stack.
- String Format Overflow in syslog() This attack targets the format string vulnerabilities in the syslog() function. An attacker would typically inject malicious input in the format string parameter of the syslog function. This is a common problem, and many public vulnerabilities and associated exploits have been posted.
Nessus
| NASL family | CGI abuses |
| NASL id | PUPPET_ENTERPRISE_2017_3_4.NASL |
| description | According to its self-reported version number, the Puppet install running on the remote host is version 5.5.x prior to 2017.3.4. It is, therefore, affected by multiple vulnerabilities: - a remote code execution vulnerability due to incorrect validation of strings in the facter_task or puppet_conf tasks. An unauthenticated remote attacker can exploit this issue to send a specially crafted string into the affected tasks to remotely execute code. (CVE-2018-6508) - an information disclosure vulnerability exists. An unauthenticated remote attacker can exploit this issue to retrieve a facts from an environment it was not classified to retrieve from. (CVE-2017-10690) |
| last seen | 2020-06-01 |
| modified | 2020-06-02 |
| plugin id | 129758 |
| published | 2019-10-09 |
| reporter | This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. |
| source | https://www.tenable.com/plugins/nessus/129758 |
| title | Puppet Enterprise < 2017.3.4 Code Execution Vulnerability |
| code | |