Login or Register to Ask a Question and Join Our Community


Security Advisories (RSS)

USN-917-1: Puppet vulnerabilities

Login to Discuss or Reply to this Discussion in Our Community

 
Thread Tools Search this Thread
Special Forums Cybersecurity Security Advisories (RSS) USN-917-1: Puppet vulnerabilities
# 1  
Old 03-24-2010
USN-917-1: Puppet vulnerabilities
Referenced CVEs:
CVE-2009-3564, CVE-2010-0156


Description:
=========================================================== Ubuntu Security Notice USN-917-1 March 24, 2010 puppet vulnerabilities CVE-2009-3564, CVE-2010-0156 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 9.10 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 9.10: puppet 0.24.8-2ubuntu4.1 In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: It was discovered that Puppet did not drop supplementary groups when being run as a different user. A local user may be able to use this flaw to bypass security restrictions and gain access to restricted files. (CVE-2009-3564) It was discovered that Puppet did not correctly handle temporary files. A local user can exploit this flaw to bypass security restrictions and overwrite arbitrary files. (CVE-2010-0156)





More...
Login or Register to Ask a Question

Previous Thread | Next Thread
Login or Register to Ask a Question

LEARN ABOUT DEBIAN

puppet-man

PUPPET-MAN(8)							   Puppet manual						     PUPPET-MAN(8)

NAME

       puppet-man - Display Puppet manual pages.

SYNOPSIS

       puppet man action

DESCRIPTION

       This  subcommand displays manual pages for all Puppet subcommands. If the ronn gem (https://github.com/rtomayko/ronn/) is installed on your
       system, puppet man will display fully-formated man pages. If ronn is not available, puppet man will display the	raw  (but  human-readable)
       source text in a pager.

OPTIONS

       Note  that  any configuration parameter that's valid in the configuration file is also a valid long argument, although it may or may not be
       relevant to the present action. For example, server is a valid configuration parameter, so you can  specify  --server  <servername>  as	an
       argument.

       See the configuration file documentation at http://docs.puppetlabs.com/references/stable/configuration.html for the full list of acceptable
       parameters. A commented list of all configuration options can also be generated by running puppet with --genconfig.

       --mode MODE
	      The run mode to use for the current action. Valid modes are user, agent, and master.

       --render-as FORMAT
	      The format in which to render output. The most common formats are json, s (string), yaml, and console, but other options such as dot
	      are sometimes available.

       --verbose
	      Whether to log verbosely.

       --debug
	      Whether to log debug information.

ACTIONS

       man - Display the manual page for a Puppet subcommand.
	      SYNOPSIS

	      puppet man subcommand

	      DESCRIPTION

	      Display the manual page for a Puppet subcommand.

	      RETURNS

	      The man data, in Markdown format, suitable for consumption by Ronn.

	      RENDERING  ISSUES:  To  skip  fancy  formatting and output the raw Markdown text (e.g. for use in a pipeline), call this action with
	      '--render-as s'.

EXAMPLES

       man

       View the manual page for a subcommand:

       $ puppet man facts

NOTES

       The pager used for display will be the first found of $MANPAGER, $PAGER, less, most, or more.

COPYRIGHT AND LICENSE

       Copyright 2011 by Puppet Labs Apache 2 license; see COPYING

Puppet Labs, LLC						     June 2012							     PUPPET-MAN(8)