CVE-2012-1053

The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors related to (1) the change_user not dropping supplementary groups in certain conditions, (2) changes to the eguid without associated changes to the egid, or (3) the addition of the real gid to supplementary groups.

Affected Software

Name	Vendor	Start Version	End Version
Puppet	Puppet	2.6.0 (including)	2.6.0 (including)
Puppet	Puppet	2.6.1 (including)	2.6.1 (including)
Puppet	Puppet	2.6.2 (including)	2.6.2 (including)
Puppet	Puppet	2.6.3 (including)	2.6.3 (including)
Puppet	Puppet	2.6.4 (including)	2.6.4 (including)
Puppet	Puppet	2.6.5 (including)	2.6.5 (including)
Puppet	Puppet	2.6.6 (including)	2.6.6 (including)
Puppet	Puppet	2.6.7 (including)	2.6.7 (including)
Puppet	Puppet	2.6.8 (including)	2.6.8 (including)
Puppet	Puppet	2.6.9 (including)	2.6.9 (including)
Puppet	Puppet	2.6.10 (including)	2.6.10 (including)
Puppet	Puppet	2.6.11 (including)	2.6.11 (including)
Puppet	Puppet	2.6.12 (including)	2.6.12 (including)
Puppet	Puppet	2.6.13 (including)	2.6.13 (including)
Puppet	Ubuntu	hardy	*
Puppet	Ubuntu	lucid	*
Puppet	Ubuntu	maverick	*
Puppet	Ubuntu	natty	*
Puppet	Ubuntu	oneiric	*
Puppet	Ubuntu	upstream	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2012-1053
CWE	https://cwe.mitre.org/data/definitions/264.html

Affected Software

References