MGASA-2013-0259

Dashboard / Vulnerabilities / MGASA-2013-0259

MGASA-2013-0259

Summary: Updated puppet and puppet3 package fix security vulnerabilities

Details: It was discovered that Puppet incorrectly handled the resource_type service. A local attacker on the master could use this issue to execute arbitrary Ruby files (CVE-2013-4761). It was discovered that Puppet incorrectly handled permissions on the modules it installed. Modules could be installed with the permissions that existed when they were built, possibly exposing them to a local attacker (CVE-2013-4956).

References: https://advisories.mageia.org/MGASA-2013-0259.html, https://bugs.mageia.org/show_bug.cgi?id=11019, http://puppetlabs.com/security/cve/cve-2013-4761/, http://puppetlabs.com/security/cve/cve-2013-4956/, http://www.ubuntu.com/usn/usn-1928-1/