Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2014-3248

Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine.

Published

2014-11-16T17:59:03.113

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 6.2 (MEDIUM)

CVSSv2 Vector

AV:L/AC:H/Au:N/C:C/I:C/A:C

  • Access Vector: LOCAL
  • Access Complexity: HIGH
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

1.9

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-17
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application puppet facter 2.0.0 Yes
Application puppet facter 2.0.0 Yes
Application puppet facter 2.0.0 Yes
Application puppet facter 2.0.0 Yes
Application puppet facter 2.0.1 Yes
Application puppet facter 2.0.1 Yes
Application puppet facter 2.0.1 Yes
Application puppet facter 2.0.1 Yes
Application puppet facter 2.0.1 Yes
Application puppetlabs facter ≤ 1.6.18 Yes
Application puppet marionette_collective < 2.5.2 Yes
Application puppet hiera < 1.3.4 Yes
Application puppet puppet < 2.7.26 Yes
Application puppet puppet < 3.6.2 Yes
Application puppet puppet_enterprise < 2.8.7 Yes
References