Puppet uses predictable filenames, allowing arbitrary file overwrite
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2012-1906US | low3.3 | — | ||
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac… | ||||
02
references
External citations — patches, advisories, analysis.
- http://projects.puppetlabs.com/issues/13260WEB
- http://puppetlabs.com/security/cve/cve-2012-1906WEB
- https://exchange.xforce.ibmcloud.com/vulnerabilities/74793WEB
- https://github.com/puppetlabs/puppet/commit/f7829ec1f1b2c3def8e0eda09c22c3c1fed3a27fWEB
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2012-1906.ymlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2012-1906ADVISORY
- https://ubuntu.com/usn/usn-1419-1WEB
- https://web.archive.org/web/20120415105345/http://www.securityfocus.com/bid/52975WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan