CVE-2012-3867: Input Validation
From puppet labs: CVE-2012-3867 (Insufficient input validation)
A bug in Puppet 2.6.16 and 2.7.17 uses insufficient input validation for agent certificate names.
An attacker can trick the administrator into signing an attacker’s certificate rather than the intended one by constructing specially crafted certificate requests containing specific ANSI control sequences. It is possible to use the sequences to rewrite the order of text displayed to an administrator such that display of an invalid certificate and valid certificate are transposed. If the administrator signs the attacker’s certificate, the attacker can then man-in-the-middle the deployment’s agent nodes.
Resolved in Puppet 2.6.17, 2.7.18
Other sources
lib/puppet/ssl/certificateauthority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3867?
CVE-2012-3867 has a moderate level of severity due to insufficient input validation in Puppet.
How do I fix CVE-2012-3867?
To fix CVE-2012-3867, upgrade Puppet to version 2.6.17 or 2.7.18 or later.
Which versions of Puppet are affected by CVE-2012-3867?
CVE-2012-3867 affects Puppet versions 2.6.16 and 2.7.17 and earlier.
What type of vulnerability is CVE-2012-3867?
CVE-2012-3867 is classified as an insufficient input validation vulnerability.
Can an attacker exploit CVE-2012-3867 remotely?
Yes, an attacker with local access could exploit CVE-2012-3867 by tricking an administrator into signing a malicious certificate.