CVE-2013-4956

Published: 20/08/2013 Updated: 10/07/2019

CVSS v2 Base Score: 3.6 | Impact Score: 4.9 | Exploitability Score: 3.9

VMScore: 320

Vector: AV:L/AC:L/Au:N/C:P/I:P/A:N

Puppet Module Tool (PMT), as used in Puppet 2.7.x prior to 2.7.23 and 3.2.x prior to 3.2.4, and Puppet Enterprise 2.8.x prior to 2.8.3 and 3.0.x prior to 3.0.1, installs modules with weak permissions if those permissions were used when the modules were originally built, which might allow local users to read or modify those modules depending on the original permissions.

Vulnerable Product	Search on Vulmon	Subscribe to Product
puppet puppet enterprise 3.0.0
puppet puppet 2.7.10
puppet puppet 2.7.18
puppet puppet 2.7.21
puppet puppet 2.7.9
puppet puppet 2.7.2
puppet puppet enterprise 2.8.0
puppet puppet 2.7.13
puppet puppet 2.7.14
puppet puppet 2.7.4
puppet puppet 2.7.5
puppet puppet 2.7.6
puppetlabs puppet 3.2.0
puppet puppet 3.2.1
puppet puppet 2.7.11
puppet puppet 2.7.12
puppet puppet 2.7.22
puppet puppet 2.7.3
puppetlabs puppet 2.7.1
puppetlabs puppet 2.7.0
puppet puppet enterprise 2.8.1
puppet puppet enterprise 2.8.2
puppet puppet 2.7.16
puppet puppet 2.7.17
puppet puppet 2.7.7
puppet puppet 2.7.8
puppet puppet 3.2.2
puppet puppet 3.2.3

Synopsis Moderate: puppet security update Type/Severity Security Advisory: Moderate Topic Updated puppet packages that fix several security issues are now availablefor Red Hat OpenStack 30The Red Hat Security Response Team has rated this update as having moderatesecurity impact Common Vulnerability Scori ...

Synopsis Critical: ruby193-puppet security update Type/Severity Security Advisory: Critical Topic Updated ruby193-puppet packages that fix three security issues are nowavailable for Red Hat OpenStack 30The Red Hat Security Response Team has rated this update as having criticalsecurity impact Common Vulne ...

Several security issues were fixed in Puppet ...

Several vulnerabilities were discovered in puppet, a centralized configuration management system The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2013-4761 The resource_type service (disabled by default) could be used to make puppet load arbitrary Ruby code from puppet master's file system CVE-2 ...

Unspecified vulnerability in Puppet 27x before 2723 and 32x before 324, and Puppet Enterprise 28x before 283 and 30x before 301, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service NOTE: this vulnerability can only be exploited utilizing unspecified "local file system access" to ...

Puppet Module Tool (PMT), as used in Puppet 27x before 2723 and 32x before 324, and Puppet Enterprise 28x before 283 and 30x before 301, installs modules with weak permissions if those permissions were used when the modules were originally built, which might allow local users to read or modify those modules depending on the original ...

CWE-264 http://puppetlabs.com/security/cve/cve-2013-4956/http://www.debian.org/security/2013/dsa-2761 http://rhn.redhat.com/errata/RHSA-2013-1284.html http://rhn.redhat.com/errata/RHSA-2013-1283.html https://access.redhat.com/errata/RHSA-2013:1283 https://usn.ubuntu.com/1928-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2013-4956

CVE-2013-4956

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect