NVD

Id
45004  
Name
CVE-2012-3408  
Description
lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address.  
Reject
 
CVSS Version
2  
CVSS Score
2.6  
Severity
Low  
CVSS Base Score
2.6  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
4.9  
CVSS Vector
(AV:N/AC:H/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2012-08-06  
Modified Date
2012-08-07  
Seq
2012-3408  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
225500 45004 CVE-2012-3408 http://puppetlabs.com/security/cve/cve-2012-3408/  View
225501 45004 CVE-2012-3408 https://bugzilla.redhat.com/show_bug.cgi?id=839166  View
225502 45004 CVE-2012-3408 https://github.com/puppetlabs/puppet/commit/ab9150baa1b738467a33b01df1d90e076253fbbd  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
27783 JVNDB-2012-003490 Puppet および Puppet Enterprise におけるエージェントを偽装される脆弱性 Puppet および Puppet Enterprise の lib/puppet/network/authstore.rb は、潜在的なリスクについて警告することなく certname の IP アドレスの使用をサポートするため、エージェントを偽装される脆弱性が存在します。 CVE-2012-3408 56646 CVE-2012-3408 45004 2.6 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-003490.html 2012-08-06 2012-08-09 View