Bug 10568 - puppet Unauthenticated Remote Code Execution Vulnerability (CVE-2013-3567)
Summary: puppet Unauthenticated Remote Code Execution Vulnerability (CVE-2013-3567)
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 3
Hardware: All Linux
Priority: Normal critical
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/555463/
Whiteboard: MGA2TOO has_procedure mga2-32-ok mga...
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2013-06-19 21:29 CEST by Nicolas Vigier
Modified: 2013-06-27 08:39 CEST (History)
3 users (show)

See Also:
Source RPM: puppet
CVE:
Status comment:


Attachments
build system web interface (90.89 KB, image/jpeg)
2013-06-27 08:39 CEST, Bogdan Gruescu
Details

Description Nicolas Vigier 2013-06-19 21:29:50 CEST
Important security issue in puppet :
http://puppetlabs.com/security/cve/cve-2013-3567/

Updated packages are available for testing for Mageia 2 and 3 in updates_testing :

SRPMS:
puppet-2.7.22-1.mga2
puppet-2.7.22-1.mga3

Mageia 2 packages :
puppet-2.7.22-1.mga2.noarch.rpm
puppet-server-2.7.22-1.mga2.noarch.rpm

Mageia 3 packages :
puppet-2.7.22-1.mga3.noarch.rpm
puppet-server-2.7.22-1.mga3.noarch.rpm


Reproducible: 

Steps to Reproduce:
Comment 1 David Walser 2013-06-19 21:39:11 CEST
Thanks Nicolas.

Ubuntu has issued an advisory for this on June 18:
http://www.ubuntu.com/usn/usn-1886-1/

Advisory:
========================

Updated puppet packages fix security vulnerability:

It was discovered that Puppet incorrectly handled YAML payloads. An attacker
on an untrusted client could use this issue to execute arbitrary code on the
master (CVE-2013-3567).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3567
http://puppetlabs.com/security/cve/cve-2013-3567/
http://www.ubuntu.com/usn/usn-1886-1/
========================

Updated packages in core/updates_testing:
========================
puppet-2.7.22-1.mga2
puppet-server-2.7.22-1.mga2
puppet-2.7.22-1.mga3
puppet-server-2.7.22-1.mga3

from SRPMS:
puppet-2.7.22-1.mga2.src.rpm
puppet-2.7.22-1.mga3.src.rpm

URL: (none) => http://lwn.net/Vulnerabilities/555463/
CC: (none) => luigiwalser
Hardware: x86_64 => All
Summary: puppet CVE-2013-3567 (Unauthenticated Remote Code Execution Vulnerability) => puppet Unauthenticated Remote Code Execution Vulnerability (CVE-2013-3567)

Comment 2 Nicolas Vigier 2013-06-19 21:40:10 CEST
Advisory file has been added to svn.
Comment 3 Nicolas Vigier 2013-06-19 22:04:33 CEST
According to release notes, the fix for this vulnerability is the only change in this release.

http://docs.puppetlabs.com/puppet/2.7/reference/release_notes.html
Comment 4 Nicolas Vigier 2013-06-19 22:47:50 CEST
puppet3 packages have also been updated in Mageia 3, from version 3.1.1 to 3.2.2. This update brings more changes according to release notes, but it's supposed to be backward compatible. Unfortunately no 3.1.x release exist, and backporting the fix from 3.2.2 does not seem simple, so the most simple solution is to update to 3.2.2.

Updated packages in core/updates_testing:
========================
puppet-2.7.22-1.mga2
puppet-server-2.7.22-1.mga2
puppet-2.7.22-1.mga3
puppet-server-2.7.22-1.mga3
emacs-puppet-2.7.22-1.mga3
vim-puppet-2.7.22-1.mga3
puppet3-3.2.2-1.mga3
puppet3-server-3.2.2-1.mga3
vim-puppet3-3.2.2-1.mga3
emacs-puppet3-3.2.2-1.mga3

from SRPMS:
puppet-2.7.22-1.mga2
puppet-2.7.22-1.mga3
puppet3-3.2.2-1.mga3
David Walser 2013-06-20 21:33:41 CEST

Whiteboard: (none) => MGA2TOO

Comment 5 claire robinson 2013-06-25 11:07:36 CEST
Testing mga3 64 & 32

Largely following http://wiki.gentoo.org/wiki/Puppet to serve a file in each direction.

Whiteboard: MGA2TOO => MGA2TOO has_procedure

Comment 6 claire robinson 2013-06-25 12:23:14 CEST
Testing complete mga3 32 & 64

Note that before using the agent as the puppetmaster for testign the other direction it is necessary to clear up. I found removing puppet completely and rm -rf /var/lib/puppet and /etc/puppet and starting again was easiest.

There is probably a puppety way to do it but the instructions it gives when it fails to start the server don't seem to correct it.



Also there is a warning on every use of puppet :

/usr/share/ruby/gems/rubygems/custom_require.rb:36:in `require': iconv will be deprecated in the future, use String#encode instead.

Nicolas, is this anything to be concerned about? It isn't a regression and doesn't affect the operation but will possibly fill logs.

Whiteboard: MGA2TOO has_procedure => MGA2TOO has_procedure mga3-32-ok mga3-64-ok

Comment 7 claire robinson 2013-06-25 13:26:32 CEST
Testing mga2 now
Comment 8 claire robinson 2013-06-25 13:49:22 CEST
Testing complete mga2 32 & 64

Validating

Could sysadmin please push from 2 & 3 core/updates_testing to core/updates

Thanks!

Keywords: (none) => validated_update
Whiteboard: MGA2TOO has_procedure mga3-32-ok mga3-64-ok => MGA2TOO has_procedure mga3-32-ok mga3-64-ok mga2-32-ok mga2-64-ok
CC: (none) => sysadmin-bugs

Comment 9 Nicolas Vigier 2013-06-25 15:45:38 CEST
(In reply to claire robinson from comment #6)
> Testing complete mga3 32 & 64

Thanks. Did you test both puppet and puppet3 packages ?

> Also there is a warning on every use of puppet :
> 
> /usr/share/ruby/gems/rubygems/custom_require.rb:36:in `require': iconv will
> be deprecated in the future, use String#encode instead.
> 
> Nicolas, is this anything to be concerned about? It isn't a regression and
> doesn't affect the operation but will possibly fill logs.

I think it's not very important.
Comment 10 claire robinson 2013-06-25 15:49:41 CEST
(In reply to Nicolas Vigier from comment #9)
> (In reply to claire robinson from comment #6)
> > Testing complete mga3 32 & 64
> 
> Thanks. Did you test both puppet and puppet3 packages ?

hrmm no, just puppet :\

So retesting needed on mga3 with puppet3 still.

Keywords: validated_update => (none)
Whiteboard: MGA2TOO has_procedure mga3-32-ok mga3-64-ok mga2-32-ok mga2-64-ok => MGA2TOO has_procedure mga2-32-ok mga2-64-ok

Comment 11 claire robinson 2013-06-25 18:51:38 CEST
I've run out of time today. In testing puppet3 the cert was signed ok but it fails on permission problems when trying to transfer the file, which is just configuration I'm sure.

Any idea's on this Nicolas?
Comment 12 claire robinson 2013-06-25 18:53:45 CEST
I think this is a setting in /etc/puppet/auth.conf but not sure what to set..

Pasting the error message in case it helps.

Error: /Stage[main]//Node[default]/File[/etc/motd]: Could not evaluate: Error 400 on SERVER: Not authorized to call find on /file_metadata/files/motd with {:links=>"manage"} Could not retrieve file metadata for puppet://puppet/files/motd: Error 400 on SERVER: Not authorized to call find on /file_metadata/files/motd with {:links=>"manage"}
Comment 13 claire robinson 2013-06-25 20:56:04 CEST
Found the solution. It needed more than a skim over the text on fileserver.conf

Added this to then end there and all is OK.

[files]
  path /var/lib/puppet/files
  allow *


Validating again, sorry for missing it originally.

Keywords: (none) => validated_update
Whiteboard: MGA2TOO has_procedure mga2-32-ok mga2-64-ok => MGA2TOO has_procedure mga2-32-ok mga2-64-ok mga3-32-ok mga3-64-ok

Comment 14 Nicolas Vigier 2013-06-26 20:51:11 CEST
http://advisories.mageia.org/MGASA-2013-0187.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED

Comment 15 Bogdan Gruescu 2013-06-27 08:39:46 CEST
Created attachment 4171 [details]
build system web interface

Nicolas, is seems that the build system still tries uselessly from time to time to build the 'puppet' package you submitted about a week ago to 'infra_2', perhaps this problem should be addressed.

CC: (none) => gruescubogdan


Note You need to log in before you can comment on or make changes to this bug.