Puppet allows local users to modify the permissions of arbitrary files
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorized_keys file.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2011-3870US | medium6.3 | — | ||
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorized_keys file. | ||||
02
references
External citations — patches, advisories, analysis.
- http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cbWEB
- http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.htmlWEB
- http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.htmlWEB
- http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.htmlWEB
- http://www.debian.org/security/2011/dsa-2314WEB
- http://www.ubuntu.com/usn/USN-1223-1WEB
- http://www.ubuntu.com/usn/USN-1223-2WEB
- https://github.com/puppetlabs/puppetPACKAGE
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan