CVE-2012-1053 Puppet Privilege Escallation
MediumCVSS 6.9
EPSS 0.38%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors related to (1) the change_user not dropping supplementary groups in certain conditions, (2) changes to the eguid without associated changes to the egid, or (3) the addition of the real gid to supplementary groups.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems puppet(RubyGems) | >= 2.6, < 2.6.14 | 2.6.14 |
| rubygems puppet(RubyGems) | >= 2.7, < 2.7.11 | 2.7.11 |
| rubygems puppet(RubyGems) | = 2.6.0 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.1 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.10 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.11 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.12 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.13 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.2 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.3 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.4 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.5 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.6 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.7 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.8 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.9 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.1 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.3 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.4 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.5 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.6 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.8 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.9 | No fix listed |
| debian/puppet(Debian:11) | < 2.7.11-1 | 2.7.11-1 |
| puppet | = 2.6.0 | No fix listed |
Show 34 more
| Product | Affected versions | Fixed in |
|---|---|---|
| puppet | = 2.6.1 | No fix listed |
| puppet | = 2.6.2 | No fix listed |
| puppet | = 2.6.3 | No fix listed |
| puppet | = 2.6.4 | No fix listed |
| puppet | = 2.6.5 | No fix listed |
| puppet | = 2.6.6 | No fix listed |
| puppet | = 2.6.7 | No fix listed |
| puppet | = 2.6.8 | No fix listed |
| puppet | = 2.6.9 | No fix listed |
| puppet | = 2.6.10 | No fix listed |
| puppet | = 2.6.11 | No fix listed |
| puppet | = 2.6.12 | No fix listed |
| puppet | = 2.6.13 | No fix listed |
| puppet | = 2.7.2 | No fix listed |
| puppet | = 2.7.3 | No fix listed |
| puppet | = 2.7.4 | No fix listed |
| puppet | = 2.7.5 | No fix listed |
| puppet | = 2.7.6 | No fix listed |
| puppet | = 2.7.7 | No fix listed |
| puppet | = 2.7.8 | No fix listed |
| puppet | = 2.7.9 | No fix listed |
| puppet | = 2.7.10 | No fix listed |
| puppetlabs puppet | = 2.7.0 | No fix listed |
| puppetlabs puppet | = 2.7.1 | No fix listed |
| puppet enterprise | = 1.2.0 | No fix listed |
| puppet enterprise | = 1.2.1 | No fix listed |
| puppet enterprise | = 1.2.2 | No fix listed |
| puppet enterprise | = 1.2.3 | No fix listed |
| puppet enterprise | = 1.2.4 | No fix listed |
| puppet enterprise | = 2.0.0 | No fix listed |
| puppet enterprise | = 2.0.1 | No fix listed |
| puppet enterprise | = 2.0.2 | No fix listed |
| puppetlabs puppet enterprise users | = 1.0 | No fix listed |
| puppetlabs puppet enterprise users | = 1.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- puppet-forked-priv-escalation(73445) vdb-entry
- github.com patch
- ubuntu.com
- web.archive.org
- web.archive.org
- web.archive.org
- web.archive.org
- web.archive.org
- web.archive.org
- www.debian.org
- github.com
- security-tracker.debian.org vendor-advisory
- SUSE-SU-2012:0325 vendor-advisory
- projects.puppetlabs.com
- projects.puppetlabs.com
- projects.puppetlabs.com
- projects.puppetlabs.com
- puppetlabs.com vendor-advisory
- 48157 third-party-advisory
- 48161 third-party-advisory vendor-advisory
- 48166 third-party-advisory vendor-advisory
- 48290 third-party-advisory vendor-advisory
- USN-1372-1 vendor-advisory
- DSA-2419 vendor-advisory
- 79495 vdb-entry
- 52158 vdb-entry
- openSUSE-SU-2012:0835 vendor-advisory