CVE

Id
70543  
CVE No.
CVE-2014-3248  
Status
Candidate  
Description
Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine.  
Phase
Assigned (20140507)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
670982 70543 CVE-2014-3248 MISC:http://rowediness.com/2014/06/13/cve-2014-3248-a-little-problem-with-puppet/  View
670983 70543 CVE-2014-3248 CONFIRM:http://puppetlabs.com/security/cve/cve-2014-3248  View
670984 70543 CVE-2014-3248 BID:68035  View
670985 70543 CVE-2014-3248 URL:http://www.securityfocus.com/bid/68035  View
670986 70543 CVE-2014-3248 SECUNIA:59197  View
670987 70543 CVE-2014-3248 URL:http://secunia.com/advisories/59197  View
670988 70543 CVE-2014-3248 SECUNIA:59200  View

Related JVN