Unscored severity · published Nov 16, 2014
CVE-2014-3248
Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and…
–
CVSS
0.5%
EPSS
No
On KEV
Description
Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FA
Facter · Puppet
2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.1; 2.0.1; +3 more · source: NVD
HI
Hiera · Puppet
before 1.3.4 · source: NVD
MC
Marionette Collective · Puppet
before 2.5.2 · source: NVD
PU
Puppet · Puppet
before 2.7.26; 3.6.0 before 3.6.2 · source: NVD
PE
Puppet Enterprise · Puppet
2.8.0 before 2.8.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3248
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3248
Vendor Advisory
http://puppetlabs.com/security/cve/cve-2014-3248
Exploit
http://rowediness.com/2014/06/13/cve-2014-3248-a-little-problem-with-puppet/
Technical Description
http://secunia.com/advisories/59197
Technical Description
http://secunia.com/advisories/59200
Third Party Advisory
http://www.securityfocus.com/bid/68035
More from Facter
–
CVE-2015-1426
Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node