CVE-2012-3408: Low severity Puppet Puppet Enterprise vulnerability
From puppet labs: Puppet agents with certnames of IP addresses can be impersonated
This affects Puppet 2.6.16 and 2.7.17
If an authenticated host with a certname of an IP address changes IP addresses, and a second host assumes the first host's former IP address, the second host will be treated by the puppet master as the first one, giving the second host access to the first host's catalog. Note: This will not be fixed in Puppet versions prior to the forthcoming 3.x. Instead, with this announcement IP-based authentication in Puppet < 3.x is deprecated.
Resolved in Puppet 2.6.17, 2.7.18
Other sources
lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3408?
CVE-2012-3408 has a medium severity rating, which indicates a moderate risk to affected systems.
How do I fix CVE-2012-3408?
To fix CVE-2012-3408, upgrade Puppet to a version higher than 2.7.18 or 2.5.2.
Which versions of Puppet are affected by CVE-2012-3408?
Puppet versions 2.6.16 and 2.7.17 are affected by CVE-2012-3408.
What security issue does CVE-2012-3408 address?
CVE-2012-3408 addresses the vulnerability where Puppet agents with certnames of IP addresses can be impersonated.
How can hosts be impersonated in the context of CVE-2012-3408?
Hosts can be impersonated if an authenticated host with a certname of an IP address changes its IP, allowing another host to assume that IP address.