Login or Register to Ask a Question and Join Our Community


Security Advisories (RSS)

USN-917-1: Puppet vulnerabilities

Login to Discuss or Reply to this Discussion in Our Community

 
Thread Tools Search this Thread
Special Forums Cybersecurity Security Advisories (RSS) USN-917-1: Puppet vulnerabilities
# 1  
Old 03-24-2010
USN-917-1: Puppet vulnerabilities
Referenced CVEs:
CVE-2009-3564, CVE-2010-0156


Description:
=========================================================== Ubuntu Security Notice USN-917-1 March 24, 2010 puppet vulnerabilities CVE-2009-3564, CVE-2010-0156 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 9.10 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 9.10: puppet 0.24.8-2ubuntu4.1 In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: It was discovered that Puppet did not drop supplementary groups when being run as a different user. A local user may be able to use this flaw to bypass security restrictions and gain access to restricted files. (CVE-2009-3564) It was discovered that Puppet did not correctly handle temporary files. A local user can exploit this flaw to bypass security restrictions and overwrite arbitrary files. (CVE-2010-0156)





More...
Login or Register to Ask a Question

Previous Thread | Next Thread
Login or Register to Ask a Question

LEARN ABOUT DEBIAN

puppet-help

PUPPET-HELP(8)							   Puppet manual						    PUPPET-HELP(8)

NAME

       puppet-help - Display Puppet help.

SYNOPSIS

       puppet help action

OPTIONS

       Note  that  any configuration parameter that's valid in the configuration file is also a valid long argument, although it may or may not be
       relevant to the present action. For example, server is a valid configuration parameter, so you can  specify  --server  <servername>  as	an
       argument.

       See the configuration file documentation at http://docs.puppetlabs.com/references/stable/configuration.html for the full list of acceptable
       parameters. A commented list of all configuration options can also be generated by running puppet with --genconfig.

       --mode MODE
	      The run mode to use for the current action. Valid modes are user, agent, and master.

       --render-as FORMAT
	      The format in which to render output. The most common formats are json, s (string), yaml, and console, but other options such as dot
	      are sometimes available.

       --verbose
	      Whether to log verbosely.

       --debug
	      Whether to log debug information.

ACTIONS

       help - Display help about Puppet subcommands and their actions.
	      SYNOPSIS

	      puppet help [--version VERSION] [subcommand] [action]

	      DESCRIPTION

	      Display help about Puppet subcommands and their actions.

	      OPTIONS

	      --version VERSION - The version of the subcommand for which to show help.

	      RETURNS

	      Short help text for the specified subcommand or action.

EXAMPLES

       help

       Get help for an action:

       $ puppet help

COPYRIGHT AND LICENSE

       Copyright 2011 by Puppet Labs Apache 2 license; see COPYING

Puppet Labs, LLC						     June 2012							    PUPPET-HELP(8)