CVE-2012-1906

Description

Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/74793

http://www.securityfocus.com/bid/52975

http://www.debian.org/security/2012/dsa-2451

http://ubuntu.com/usn/usn-1419-1

http://secunia.com/advisories/48789

http://secunia.com/advisories/48748

http://secunia.com/advisories/48743

http://puppetlabs.com/security/cve/cve-2012-1906/

http://projects.puppetlabs.com/issues/13260

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3