-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
                         AUSCERT Security Bulletin

                               ASB-2013.0019
        A number of vulnerabilities have been identified in Puppet
                             11 February 2013

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              Puppet
Operating System:     UNIX variants (UNIX, Linux, OSX)
Impact/Access:        Access Privileged Data     -- Existing Account            
                      Cross-site Request Forgery -- Remote with User Interaction
Resolution:           Patch/Upgrade
CVE Names:            CVE-2013-1399 CVE-2013-1398 
Member content until: Wednesday, March 13 2013

OVERVIEW

        Multiple vulnerabilities have been identified in Puppet Enterprise 
        prior to version 2.7.1. [1, 2]


IMPACT

        The vendor has provided the following details regarding two 
        vulnerabilities which affect versions 2.0 and later prior to version
        2.7.1:
        
        "CVE-2013-1398 (MCO Private Key Leak)
        Posted February 6, 2013
        
        Under certain circumstances, a user with root access to a single node
        in a PE deployment could possibly manipulate that client's local facts
        in order to force the pe_mcollective module to deliver a catalog 
        containing SSL keys. These keys could be used to access other nodes in 
        the collective and send them arbitrary commands as root.
        
        This vulnerability affects the master role of Puppet Enterprise." [1]
        
        "CVE-2013-1399 (Console CSRF Vulnerability):
        Posted February 6, 2013
        
        Several components of the Puppet Enterprise console were vulnerable to
        CSRF attacks.
        
        Cross site request forgery (CSRF) protection has been added to the 
        following areas of the PE console: node request management, live 
        management, and user administration. Now, basically every HTML form
        submitted to a server running one of these services gets a randomly 
        generated token whose authenticity is compared against a token stored by
        the session of the currently logged-in user. Requests with tokens that
        do not authenticate (or are not present) will be answered with a 
        "403 Forbidden" HTML status.
        
        One exception to the CSRF protection model are HTTP requests that use
        basic HTTP user authorization. These are treated as API requests and, 
        since by definition they include a valid (or not) username and password,
        they are considered secure.
        
        Note that the Rails-based puppet dashboard application is not vulnerable 
        due to Rail's built in CSRF protection.
        
        This vulnerability affects the console role of Puppet Enterprise." [2]


MITIGATION

        The vendor recommends updating to the latest versions of Puppet 
        Enterprise to correct these issues. [1, 2]


REFERENCES

        [1] CVE-2013-1398
            https://puppetlabs.com/security/cve/cve-2013-1398/

        [2] CVE-2013-1399
            https://puppetlabs.com/security/cve/cve-2013-1399/

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBURiDMO4yVqjM2NGpAQJIwA/9GyxtaMmV45+dlZcTl1PkRfn6qZ0a9Qkj
tM4mUynLCIUM00kqorYUZ+cGsNMBHPY1wAb0mrXq/gred5kzcpV5Ch6fmFqr6qXt
YsaQDGvGdoQjjB24W++822Wuq1gidpDQ6+c0P4WEEwb8QFpysGYQmABDrqQggKBo
/CzI0bhPea8/fwlttPwgl8EQTh9u2hQYr+FaYMXWEY851TSWSvvkV8S27C5le6n7
mzpuLz+x5B2LooGoZS+WRcUC9bclt1cGQk0ENxnhJxE9q+osm9MPPlONhzHRMmD2
AT8Xr1JcDezrZgZy61AUIkJPbyx0EDY5y1Q9fjiZrR4guad9Q1CP0xa+3ML7QxkV
BS5zMNd26V+x+IEbdBMDXxk45aHM05PK+JOlydim8u1jTQ5IxV96XzZ4Ev3zac0H
9iIVc8CeH4wePF6dfshTNu83AOE6qoJUr4reADIGo2bbXQEBpdbm2JDUoKuhymiW
a4xQCgxjHzRFEe8dGeR3a/0S8gwE1tAu2q+5VWSmuMzXLxfuenQth+jrT0PB8iLg
qXseSvalTvlsY5sh9q/M1VSqpJQnrpH3IMgXsaJr9eN3OPRhrayIyRfNhVUzxY98
9Zhh4fdKzkivJsncryiNUmsHcwEEPh4q4qpsW8dxqUPNJRPrSGlpfLhatlYAcSG/
eVOYOvdcYQY=
=2wQz
-----END PGP SIGNATURE-----