6.9

CVE-2012-1053

The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors related to (1) the change_user not dropping supplementary groups in certain conditions, (2) changes to the eguid without associated changes to the egid, or (3) the addition of the real gid to supplementary groups.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Puppet ≫ Puppet Version 2.6.0
Puppet ≫ Puppet Version 2.6.1
Puppet ≫ Puppet Version 2.6.2
Puppet ≫ Puppet Version 2.6.3
Puppet ≫ Puppet Version 2.6.4
Puppet ≫ Puppet Version 2.6.5
Puppet ≫ Puppet Version 2.6.6
Puppet ≫ Puppet Version 2.6.7
Puppet ≫ Puppet Version 2.6.8
Puppet ≫ Puppet Version 2.6.9
Puppet ≫ Puppet Version 2.6.10
Puppet ≫ Puppet Version 2.6.11
Puppet ≫ Puppet Version 2.6.12
Puppet ≫ Puppet Version 2.6.13
Puppet ≫ Puppet Version 2.7.2
Puppet ≫ Puppet Version 2.7.3
Puppet ≫ Puppet Version 2.7.4
Puppet ≫ Puppet Version 2.7.5
Puppet ≫ Puppet Version 2.7.6
Puppet ≫ Puppet Version 2.7.7
Puppet ≫ Puppet Version 2.7.8
Puppet ≫ Puppet Version 2.7.9
Puppet ≫ Puppet Version 2.7.10
Puppetlabs ≫ Puppet Version 2.7.0
Puppetlabs ≫ Puppet Version 2.7.1
Puppet ≫ Puppet Enterprise Version 1.2.0
Puppet ≫ Puppet Enterprise Version 1.2.1
Puppet ≫ Puppet Enterprise Version 1.2.2
Puppet ≫ Puppet Enterprise Version 1.2.3
Puppet ≫ Puppet Enterprise Version 1.2.4
Puppet ≫ Puppet Enterprise Version 2.0.0
Puppet ≫ Puppet Enterprise Version 2.0.1
Puppet ≫ Puppet Enterprise Version 2.0.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.38% 0.3
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.9 3.4 10
AV:L/AC:M/Au:N/C:C/I:C/A:C
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html
http://projects.puppetlabs.com/issues/12457
http://projects.puppetlabs.com/issues/12458
http://projects.puppetlabs.com/issues/12459
http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14
http://puppetlabs.com/security/cve/cve-2012-1053/
Vendor Advisory
http://secunia.com/advisories/48157
http://secunia.com/advisories/48161
Vendor Advisory
http://secunia.com/advisories/48166
Vendor Advisory
http://secunia.com/advisories/48290
Vendor Advisory
http://ubuntu.com/usn/usn-1372-1
http://www.debian.org/security/2012/dsa-2419
http://www.osvdb.org/79495
http://www.securityfocus.com/bid/52158
https://exchange.xforce.ibmcloud.com/vulnerabilities/73445
https://hermes.opensuse.org/messages/15087408