CVE-2013-4969 Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files.
LowCVSS 2.1
EPSS 0.43%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/puppet(Debian:11) | < 3.4.1-1 | 3.4.1-1 |
| puppetlabs puppet | >= 3.0.0, <= 3.3.2 | No fix listed |
| puppetlabs puppet | >= 3.4.0, < 3.4.1 | 3.4.1 |
| puppet enterprise | >= 2.0.0, < 2.8.4 | 2.8.4 |
| puppet enterprise | >= 3.1, < 3.1.1 | 3.1.1 |
| debian linux | = 6.0 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 12.10 | No fix listed |
| Canonical Ubuntu Linux | = 13.04 | No fix listed |
| Canonical Ubuntu Linux | = 13.10 | No fix listed |
References
- security-tracker.debian.org vendor-advisory
- puppetlabs.com vendor-advisory
- 56253 third-party-advisory vendor-advisory
- 56254 third-party-advisory vendor-advisory
- DSA-2831 third-party-advisory vendor-advisory
- USN-2077-1 third-party-advisory vendor-advisory