SB2013032003 - Input validation error in Puppet

Description

This security bulletin contains information about 1 security vulnerability.

1) Input validation error (CVE-ID: CVE-2013-1640)

The vulnerability allows a remote #AU# to execute arbitrary code.

The (1) template and (2) inline_template functions in the master server in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users to execute arbitrary code via a crafted catalog request. Per http://www.ubuntu.com/usn/usn-1759-1/ "A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 12.10 Ubuntu 12.04 LTS Ubuntu 11.10"

Remediation

Install update from vendor's website.

References

• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html
• http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html
• http://rhn.redhat.com/errata/RHSA-2013-0710.html
• http://secunia.com/advisories/52596
• http://ubuntu.com/usn/usn-1759-1
• http://www.debian.org/security/2013/dsa-2643
• https://puppetlabs.com/security/cve/cve-2013-1640/