NVD

Id
10440  
Name
CVE-2011-3872  
Description
Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master"s certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof a Puppet master via a man-in-the-middle (MITM) attack against an agent that uses an alternate DNS name for the master, aka "AltNames Vulnerability."  
Reject
 
CVSS Version
2  
CVSS Score
2.6  
Severity
Low  
CVSS Base Score
2.6  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
4.9  
CVSS Vector
(AV:N/AC:H/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-07  
Published
2011-10-27  
Modified Date
2012-02-14  
Seq
2011-3872  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
59261 10440 CVE-2011-3872 http://groups.google.com/group/puppet-announce/browse_thread/thread/e7edc3a71348f3e1  View
59262 10440 CVE-2011-3872 http://puppetlabs.com/blog/important-security-announcement-altnames-vulnerability/  View
59263 10440 CVE-2011-3872 50356  View
59264 10440 CVE-2011-3872 USN-1238-1  View
59265 10440 CVE-2011-3872 USN-1238-2  View
59266 10440 CVE-2011-3872 puppet-x509-spoofing(70970)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
32457 JVNDB-2011-002697 Puppet および Puppet Enterprise Users における Puppet master になりすまされる脆弱性 Puppet Labs の Puppet および Puppet Enterprise Users は、エージェントの証明書に署名する際、証明書の X.509 Subject Alternative Name フィールドに、Puppet master の certdnsnames 値を追加するため、Puppet master になりすまされる脆弱性が存在します。 CVE-2011-3872 51779 CVE-2011-3872 10440 2.6 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-002697.html 2011-10-24 2011-11-04 View