CVE-2017-2290: High severity Puppet Mcollective-puppet-agent Puppet vulnerability
On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an executable that will be executed with administrator privileges on the next "mco puppet" run. Puppet Enterprise users are not affected. This is resolved in mcollective-puppet-agent 1.12.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mcollective-puppet-agentto a version that resolves this vulnerability.Fixed in 1.12.1
Event History
Frequently Asked Questions
What is the severity of CVE-2017-2290?
CVE-2017-2290 has been rated as a high severity vulnerability due to the potential for privilege escalation by non-administrator users.
How does CVE-2017-2290 affect mcollective-puppet-agent?
CVE-2017-2290 allows non-administrator users on Windows to create executables that run with administrator privileges during the next 'mco puppet' execution.
Who is affected by CVE-2017-2290?
CVE-2017-2290 specifically affects Windows installations of mcollective-puppet-agent version 1.12.0, while Puppet Enterprise users are not impacted.
How do I fix CVE-2017-2290?
To fix CVE-2017-2290, upgrade the mcollective-puppet-agent to a version beyond 1.12.0 that addresses this vulnerability.
Is there a mitigation for CVE-2017-2290?
The best mitigation for CVE-2017-2290 is to ensure that users without administrative privileges are not allowed to execute the 'mco puppet' command.