CVE-2011-0528

Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources of other nodes via unspecified vectors.

Published Bysecalert@redhat.com

Published DateFeb 17, 2014, 16:55

Affected Versions(1)

puppet(RubyGems)

Introduced2.6.0

Fixed2.6.4

LimitN/A

Package (Ecosystem)	Introduced	Fixed	Limit
puppet(RubyGems)	2.6.0	2.6.4	N/A

Weakness Type (CWE):CWE-264

CVSS Metrics

Base Score

5.5

Vector String

AV:N/AC:L/Au:S/C:P/I:P/A:N

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

NONE

References

http://www.mail-archive.com/puppet-users%40googlegroups.com/msg16429.html
http://www.openwall.com/lists/oss-security/2011/01/27/6
http://www.openwall.com/lists/oss-security/2011/01/31/5
http://www.ubuntu.com/usn/USN-1365-1

Weakness Type (CWE):CWE-264

CVSS Metrics

Base Score

5.5

Vector String

AV:N/AC:L/Au:S/C:P/I:P/A:N

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

NONE