CVE-2012-3865

2012-08-06 18:55:06 2019-07-10 20:02:28

Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.

Vector

NETWORK

Complexity

MEDIUM

Authentication

SINGLE_INSTANCE

Confidentiality

NONE

Integrity

NONE

Availability

PARTIAL

Puppetlabs Puppet 2.7.17 Puppetlabs Puppet 2.7.1 Puppetlabs Puppet 2.7.0 Puppetlabs Puppet 2.6.16 Puppet Puppet enterprise 2.5.1 (not an official CPE) Puppet Puppet 2.7.16 (not an official CPE) Puppet Puppet 2.7.14 (not an official CPE) Puppet Puppet 2.7.13 (not an official CPE) Puppet Puppet 2.7.12 (not an official CPE) Puppet Puppet 2.7.11 (not an official CPE) Puppet Puppet 2.7.10 (not an official CPE) Puppet Puppet 2.7.9 (not an official CPE) Puppet Puppet 2.7.8 (not an official CPE) Puppet Puppet 2.7.6 (not an official CPE) Puppet Puppet 2.7.5 (not an official CPE) Puppet Puppet 2.7.4 (not an official CPE) Puppet Puppet 2.7.3 (not an official CPE) Puppet Puppet 2.7.2 (not an official CPE) Puppet Puppet 2.6.15 (not an official CPE) Puppet Puppet 2.6.14 (not an official CPE) Puppet Puppet 2.6.13 (not an official CPE) Puppet Puppet 2.6.12 (not an official CPE) Puppet Puppet 2.6.11 (not an official CPE) Puppet Puppet 2.6.10 (not an official CPE) Puppet Puppet 2.6.9 (not an official CPE) Puppet Puppet 2.6.8 (not an official CPE) Puppet Puppet 2.6.7 (not an official CPE) Puppet Puppet 2.6.6 (not an official CPE) Puppet Puppet 2.6.5 (not an official CPE) Puppet Puppet 2.6.4 (not an official CPE) Puppet Puppet 2.6.3 (not an official CPE) Puppet Puppet 2.6.2 (not an official CPE) Puppet Puppet 2.6.1 (not an official CPE) Puppet Puppet 2.6.0 (not an official CPE)

Puppetlabs - Puppet Puppet - Puppet enterprise Puppet - Puppet

Advisory	Patch	Confirmed	Link
			https://bugzilla.redhat.com/show_bug.cgi?id=839131
			https://github.com/puppetlabs/puppet/commit/554eefc55f57...
			https://github.com/puppetlabs/puppet/commit/d80478208d79...
			USN-1506-1
			DSA-2511
			http://puppetlabs.com/security/cve/cve-2012-3865/
			openSUSE-SU-2012:0891
			SUSE-SU-2012:0983

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (ID 22)

Related CAPEC 7 Relative Path Traversal (CAPEC-ID 139) Directory Traversal (CAPEC-ID 213) File System Function Injection, Content Based (CAPEC-ID 23) Using Slashes and URL Encoding Combined to Bypass Validation Logic (CAPEC-ID 64) Manipulating Input to File System Calls (CAPEC-ID 76) Using Escaped Slashes in Alternate Encoding (CAPEC-ID 78) Using Slashes in Alternate Encoding (CAPEC-ID 79)