NetSight
IP …
low3.6

CVE-2012-1989

telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a s…

Impact

telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log).

Affected products

VendorProductAffected versions
PuppetPuppet
Versions 2.7.3, 2.7.4, 2.7.5, 2.7.6, 2.7.8, 2.7.9
PuppetlabsPuppet
Versions 2.7.0, 2.7.1
PuppetPuppet Enterprise
Versions 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 2.0.0

Weakness classification

CWE-264

References