Published: 27/10/2011 Updated: 11/07/2019

CVSS v2 Base Score: 2.6 | Impact Score: 2.9 | Exploitability Score: 4.9

VMScore: 231

Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N

Puppet 2.6.x prior to 2.6.12 and 2.7.x prior to 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 prior to 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote malicious users to spoof a Puppet master via a man-in-the-middle (MITM) attack against an agent that uses an alternate DNS name for the master, aka "AltNames Vulnerability."

Vulnerable Product	Search on Vulmon	Subscribe to Product
puppet puppet 2.6.1
puppet puppet 2.6.8
puppetlabs puppet 2.7.0
puppet puppet 2.7.4
puppet puppet 2.6.9
puppet puppet 2.6.10
puppet puppet 2.6.7
puppet puppet 2.6.6
puppet puppet 2.7.3
puppet puppet 2.7.5
puppet puppet 2.6.0
puppet puppet 2.6.4
puppet puppet 2.6.5
puppet puppet 2.6.11
puppet puppet 2.6.3
puppet puppet 2.6.2
puppet puppet 2.7.2
puppetlabs puppet 2.7.1
puppet puppet enterprise 1.2.2
puppet puppet enterprise 1.2.3
puppetlabs puppet enterprise users 1.0
puppet puppet enterprise 1.2.0
puppetlabs puppet enterprise users 1.1
puppet puppet enterprise 1.2.1

The Puppet master server could be impersonated in certain configurations ...

It was discovered that Puppet, a centralized configuration management solution, misgenerated certificates if the certdnsnames option was used This could lead to man in the middle attacks More details are available on the Puppet web site For the oldstable distribution (lenny), this problem has been fixed in version 0245-3+lenny2 For the stabl ...

Puppet Module to help fix and migrate a Puppet deployment (CVE-2011-3872)

CVE-2011-3872 Remediation Toolkit This module will help you permanently remediate the CVE-2011-3872 AltNames vulnerability Usage Guides Please see the detailed usage guides at: README-detailedmarkdown (for remediating your site with Puppet) README-ssh-onlymarkdown (For remediating your site with SSH) Summary If your puppet master's certdnsnames setting has ever been

CWE-20 http://groups.google.com/group/puppet-announce/browse_thread/thread/e7edc3a71348f3e1 http://secunia.com/advisories/46578 http://www.ubuntu.com/usn/USN-1238-1 http://puppetlabs.com/blog/important-security-announcement-altnames-vulnerability/http://www.ubuntu.com/usn/USN-1238-2 http://secunia.com/advisories/46550 http://www.securityfocus.com/bid/50356 http://secunia.com/advisories/46934 http://secunia.com/advisories/46964 https://exchange.xforce.ibmcloud.com/vulnerabilities/70970 https://puppet.com/security/cve/cve-2011-3872 https://usn.ubuntu.com/1238-1/https://nvd.nist.gov

CVE-2011-3872

Vulnerability Summary

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect