CVE-2012-1906 Puppet uses predictable filenames, allowing arbitrary file overwrite
LowCVSS 3.3
EPSS 0.35%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems puppet(RubyGems) | >= 2.6, < 2.6.15 | 2.6.15 |
| rubygems puppet(RubyGems) | >= 2.7, < 2.7.13 | 2.7.13 |
| rubygems puppet(RubyGems) | = 2.6.0 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.1 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.10 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.11 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.12 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.13 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.14 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.2 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.3 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.4 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.5 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.6 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.7 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.8 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.9 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.1 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.11 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.12 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.3 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.4 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.5 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.6 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.8 | No fix listed |
Show 40 more
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems puppet(RubyGems) | = 2.7.9 | No fix listed |
| debian/puppet(Debian:11) | < 2.7.13-1 | 2.7.13-1 |
| puppet | = 2.6.0 | No fix listed |
| puppet | = 2.6.1 | No fix listed |
| puppet | = 2.6.2 | No fix listed |
| puppet | = 2.6.3 | No fix listed |
| puppet | = 2.6.4 | No fix listed |
| puppet | = 2.6.5 | No fix listed |
| puppet | = 2.6.6 | No fix listed |
| puppet | = 2.6.7 | No fix listed |
| puppet | = 2.6.8 | No fix listed |
| puppet | = 2.6.9 | No fix listed |
| puppet | = 2.6.10 | No fix listed |
| puppet | = 2.6.11 | No fix listed |
| puppet | = 2.6.12 | No fix listed |
| puppet | = 2.6.13 | No fix listed |
| puppet | = 2.6.14 | No fix listed |
| puppet | = 2.7.2 | No fix listed |
| puppet | = 2.7.3 | No fix listed |
| puppet | = 2.7.4 | No fix listed |
| puppet | = 2.7.5 | No fix listed |
| puppet | = 2.7.6 | No fix listed |
| puppet | = 2.7.7 | No fix listed |
| puppet | = 2.7.8 | No fix listed |
| puppet | = 2.7.9 | No fix listed |
| puppet | = 2.7.10 | No fix listed |
| puppet | = 2.7.11 | No fix listed |
| puppet enterprise | = 2.5.0 | No fix listed |
| puppet enterprise | = 1.2.0 | No fix listed |
| puppet enterprise | = 1.2.1 | No fix listed |
| puppet enterprise | = 1.2.2 | No fix listed |
| puppet enterprise | = 1.2.3 | No fix listed |
| puppet enterprise | = 1.2.4 | No fix listed |
| puppet enterprise | = 2.0.0 | No fix listed |
| puppet enterprise | = 2.0.1 | No fix listed |
| puppet enterprise | = 2.0.2 | No fix listed |
| puppetlabs puppet | = 2.7.0 | No fix listed |
| puppetlabs puppet | = 2.7.1 | No fix listed |
| puppetlabs puppet enterprise users | = 1.0 | No fix listed |
| puppetlabs puppet enterprise users | = 1.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- puppet-macosx-symlink(74793) vdb-entry
- github.com patch
- ubuntu.com
- web.archive.org
- www.debian.org
- github.com exploit
- projects.puppetlabs.com vendor-advisory
- puppetlabs.com vendor-advisory
- github.com
- security-tracker.debian.org vendor-advisory
- 48743 third-party-advisory vendor-advisory
- 48748 third-party-advisory vendor-advisory
- 48789 third-party-advisory vendor-advisory
- USN-1419-1 vendor-advisory
- DSA-2451 vendor-advisory
- 52975 vdb-entry