CVE-2012-3408 (published 2012-08-06T16:55Z)

lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address.

Severity: LOW
CVSS v2 base score: 2.6 (AV:N/AC:H/Au:N/C:P/I:N/A:N)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/puppetlabs/puppet
commit_details: repo_url: https://github.com/puppetlabs/puppet
author: Nick Lewis
author_date: 2012-06-26 16:46:45-07:00
msg: Deprecate IP-based authentication

This will need to be made explicit in a future version, so it's good to
get people to stop using it if possible.
repository: repo_url: https://github.com/puppetlabs/puppet
repo_name: puppetlabs/puppet
description: Server automation framework and application
repo_language: Ruby
owner: puppetlabs
file_changes: filename: authstore.rb
change_type: ModificationType.MODIFY
diff: @@ -150,7 +150,16 @@ module Puppet
 
       # Does this declaration match the name/ip combo?
       def match?(name, ip)
-        ip? ? pattern.include?(IPAddr.new(ip)) : matchname?(name)
+        if ip?
+          if pattern.include?(IPAddr.new(ip))
+            Puppet.deprecation_warning "Authentication based on IP address is deprecated; please use certname-based rules instead"
+            true
+          else
+            false
+          end
+        else
+          matchname?(name)
+        end
       end
 
       # Set the pattern appropriately.  Also sets the name and length.
@@ -212,7 +221,6 @@ module Puppet
 
       # Convert the name to a common pattern.
       def munge_name(name)
-        # LAK:NOTE http://snurl.com/21zf8  [groups_google_com]
         # Change to name.downcase.split(".",-1).reverse for FQDN support
         name.downcase.split(".").reverse
       end

programming_language: Ruby
filename: rest_authconfig_spec.rb
change_type: ModificationType.MODIFY
diff: @@ -44,12 +44,31 @@ describe Puppet::Network::RestAuthConfig do
   end
 
   def request(args = {})
-    { :ip => '10.1.1.1', :node => 'host.domain.com', :key => 'key', :authenticated => true }.each do |k,v|
-      args[k] ||= v
-    end
+    args = {
+      :key => 'key',
+      :node => 'host.domain.com',
+      :ip => '10.1.1.1',
+      :authenticated => true
+    }.merge(args)
     ['test', :find, args[:key], args]
   end
 
+  it "should warn when matching against IP addresses" do
+    add_rule("allow 10.1.1.1")
+
+    @auth.should allow(request)
+
+    @logs.should be_any {|log| log.level == :warning and log.message =~ /Authentication based on IP address is deprecated/}
+  end
+
+  it "should not warn when matches against IP addresses fail" do
+    add_rule("allow 10.1.1.2")
+
+    @auth.should_not allow(request)
+
+    @logs.should_not be_any {|log| log.level == :warning and log.message =~ /Authentication based on IP address is deprecated/}
+  end
+
   it "should support IPv4 address" do
     add_rule("allow 10.1.1.1")
 

programming_language: Ruby