CVE-2014-3248

MediumCVSS 6.2/10Last modified Jun 17, 2026

Description

Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine.

Metrics

CVSS 2.0 6.2/10AV:L/AC:H/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-17

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://puppetlabs.com/security/cve/cve-2014-3248Vendor Advisory
http://rowediness.com/2014/06/13/cve-2014-3248-a-little-problem-with-puppet/Exploit, Technical Description
http://secunia.com/advisories/59197Technical Description
http://secunia.com/advisories/59200Technical Description
http://www.securityfocus.com/bid/68035Third Party Advisory, VDB Entry
http://puppetlabs.com/security/cve/cve-2014-3248Vendor Advisory
http://rowediness.com/2014/06/13/cve-2014-3248-a-little-problem-with-puppet/Exploit, Technical Description
http://secunia.com/advisories/59197Technical Description
http://secunia.com/advisories/59200Technical Description
http://www.securityfocus.com/bid/68035Third Party Advisory, VDB Entry

Timeline

Published: Nov 16, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-32495.0Puppet Enterprise 2.8.x before 2.8.7 allows remote attackers to obtain sensitive information via vectors involving hiding and unhiding nodes CVE-2014-32506.5The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which might allow remote at CVE-2014-32514.4The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new CVE-2014-32607.5Pacom 1000 CCU and RTU GMS devices allow remote attackers to spoof the controller-to-base data stream by leveraging improper use of cryptogr CVE-2014-32617.6Buffer overflow in the Smart Call Home implementation in Cisco NX-OS on Fabric Interconnects in Cisco Unified Computing System 1.4 before 1.CVE-2014-32624.3The Locator/ID Separation Protocol (LISP) implementation in Cisco IOS 15.3(3)S and earlier and IOS XE does not properly validate parameters CVE-2014-32635.4The ScanSafe module in Cisco IOS 15.3(3)M allows remote attackers to cause a denial of service (device reload) via HTTPS packets that requir CVE-2014-32646.3Cisco Adaptive Security Appliance (ASA) Software 9.1(.5) and earlier allows remote authenticated users to cause a denial of service (device CVE-2014-32654.3Cross-site scripting (XSS) vulnerability in the Auto Update Server (AUS) web framework in Cisco Security Manager 4.2 and earlier allows remo CVE-2014-32664.3Cross-site scripting (XSS) vulnerability in the web framework in Cisco Security Manager 4.6 and earlier allows remote attackers to inject ar CVE-2014-32676.8Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Security Manager 4.6 and earlier allows remote attackers to hi CVE-2014-32685.0Cisco IOS 15.2(4)M4 on Cisco Unified Border Element (CUBE) devices allows remote attackers to cause a denial of service (input-queue consump