Overview

CVE-2012-1989 (Arbitrary File Write Access)

A bug in Puppet uses a predictable file name and allows writing to files on the puppet master.

The telnet connection type for managing network devices opens a NET::Telnet connection whose output log is written to a predictable location (/tmp/out.log). That log can be replaced by a symlink to an arbitrary location, potentially overwriting files.

Note: This only affects the 2.7 series of Puppet.

Status

  • Resolved in 2.7.13 (source), rpm, deb
  • Resolved in Puppet Enterprise 2.5.1
  • Hotfixes available for Puppet Enterprise 2.0.x

Hotfixes