CVE-2012-1989

telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log).

Published: Jun 27, 2012
Updated: May 9, 2024
CVE: CVE-2012-1989
GHSA: GHSA-c5qq-g673-5p49
Severity: Low
Exploit:

CVSS v2:

Severity: Low
Score: 3.6
AV:L/AC:L/Au:N/C:N/I:P/A:P

CWEs:

CWE-264

Affected Software
References

Software	From	Fixed in
puppetlabs / puppet	2.7.0	2.7.0.x
puppetlabs / puppet	2.7.1	2.7.1.x
puppet / puppet	2.7.3	2.7.3.x
puppet / puppet	2.7.4	2.7.4.x
puppet / puppet	2.7.5	2.7.5.x
puppet / puppet	2.7.6	2.7.6.x
puppet / puppet	2.7.8	2.7.8.x
puppet / puppet	2.7.9	2.7.9.x
puppet / puppet	2.7.10	2.7.10.x
puppet / puppet	2.7.11	2.7.11.x
puppet / puppet	2.7.12	2.7.12.x
puppet / puppet_enterprise	1.2.0	1.2.0.x
puppet / puppet_enterprise	2.0.0	2.0.0.x
puppet / puppet_enterprise	2.0.1	2.0.1.x
puppet / puppet_enterprise	2.0.2	2.0.2.x
puppet / puppet_enterprise	1.2.1	1.2.1.x
puppet / puppet_enterprise	1.2.2	1.2.2.x
puppet / puppet_enterprise	1.2.3	1.2.3.x
puppet / puppet_enterprise	1.2.4	1.2.4.x
puppet / puppet_enterprise	2.5.0	2.5.0.x
puppet	2.7.1	2.7.13

Vulnerability Database

CVE-2012-1989

Deep Security Visibility Without the Complexity