CVE-2010-0156 Puppet arbitrary files overwrite via a symlink attack
LowCVSS 3.3
EPSS 0.33%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Puppet 0.24.x before 0.24.9 and 0.25.x before 0.25.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/daemonout, (2) /tmp/puppetdoc.txt, (3) /tmp/puppetdoc.tex, or (4) /tmp/puppetdoc.aux temporary file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems puppet(RubyGems) | >= 0.24.0, < 0.24.9 | 0.24.9 |
| rubygems puppet(RubyGems) | >= 0.25.0, < 0.25.2 | 0.25.2 |
| rubygems puppet(RubyGems) | = 0.24.0 | No fix listed |
| rubygems puppet(RubyGems) | = 0.24.1 | No fix listed |
| rubygems puppet(RubyGems) | = 0.24.2 | No fix listed |
| rubygems puppet(RubyGems) | = 0.24.3 | No fix listed |
| rubygems puppet(RubyGems) | = 0.24.4 | No fix listed |
| rubygems puppet(RubyGems) | = 0.24.5 | No fix listed |
| rubygems puppet(RubyGems) | = 0.24.6 | No fix listed |
| rubygems puppet(RubyGems) | = 0.24.7 | No fix listed |
| rubygems puppet(RubyGems) | = 0.24.8 | No fix listed |
| rubygems puppet(RubyGems) | = 0.25.0 | No fix listed |
| rubygems puppet(RubyGems) | = 0.25.1 | No fix listed |
| puppet | = 0.24.3 | No fix listed |
| puppet | = 0.24.4 | No fix listed |
| puppet | = 0.24.5 | No fix listed |
| puppet | = 0.24.6 | No fix listed |
| puppet | = 0.24.6-rc1 | No fix listed |
| puppet | = 0.24.6-rc2 | No fix listed |
| puppet | = 0.24.7 | No fix listed |
| puppet | = 0.24.7-rc2 | No fix listed |
| puppet | = 0.24.8 | No fix listed |
| puppet | = 0.24.8-rc1 | No fix listed |
| puppet | = 0.25.0 | No fix listed |
| puppet | = 0.25.0-beta1 | No fix listed |
Show 9 more
| Product | Affected versions | Fixed in |
|---|---|---|
| puppet | = 0.25.0-beta2 | No fix listed |
| puppet | = 0.25.0-rc1 | No fix listed |
| puppet | = 0.25.1 | No fix listed |
| puppet | = 0.25.1-rc1 | No fix listed |
| puppet | = 0.25.1-rc2 | No fix listed |
| puppet | = 0.25.2-rc1 | No fix listed |
| puppet | = 0.25.2-rc2 | No fix listed |
| puppet | = 0.25.2-rc3 | No fix listed |
| debian/puppet(Debian:11) | < 0.25.4-2 | 0.25.4-2 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugzilla.redhat.com patch
- puppet.com
- [puppet-announce] 20100105 ANNOUNCE: Puppet 0.25.2 "Zoe" now available! mailing-list patch
- [puppet-announce] 20100108 ANNOUNCE: Puppet 0.24.9 is available mailing-list
- FEDORA-2010-1079 vendor-advisory
- FEDORA-2010-1372 vendor-advisory
- SUSE-SR:2010:013 vendor-advisory
- github.com patch
- github.com patch
- web.archive.org
- github.com exploit
- github.com
- github.com product
- 38766 patch third-party-advisory vendor-advisory
- security-tracker.debian.org vendor-advisory