Lucene search

MitreCVE-2012-1989

HistoryJun 27, 2012 - 6:55 p.m.

CVE-2012-1989

2012-06-2718:55:01

CWE-264

mitre

web.nvd.nist.gov

cve-2012-1989

telnet.rb

puppet

puppet 2.7

puppet enterprise 1.2

puppet enterprise 2.0

puppet enterprise 2.5

symlink attack

nvd

CVSS2

3.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:P/A:P

AI Score

6.1

Confidence

Low

EPSS

Percentile

5.1%

JSON

telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log).

Affected configurations

Nvd

Node

puppetpuppetMatch2.7.3

puppetpuppetMatch2.7.4

puppetpuppetMatch2.7.5

puppetpuppetMatch2.7.6

puppetpuppetMatch2.7.8

puppetpuppetMatch2.7.9

puppetpuppetMatch2.7.10

puppetpuppetMatch2.7.11

puppetpuppetMatch2.7.12

puppetlabspuppetMatch2.7.0

puppetlabspuppetMatch2.7.1

Node

puppetpuppet_enterpriseMatch1.2.0

puppetpuppet_enterpriseMatch1.2.1

puppetpuppet_enterpriseMatch1.2.2

puppetpuppet_enterpriseMatch1.2.3

puppetpuppet_enterpriseMatch1.2.4

puppetpuppet_enterpriseMatch2.0.0

puppetpuppet_enterpriseMatch2.0.1

puppetpuppet_enterpriseMatch2.0.2

puppetpuppet_enterpriseMatch2.5.0

VendorProductVersionCPE
puppetpuppet2.7.3cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*
puppetpuppet2.7.4cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*
puppetpuppet2.7.5cpe:2.3:a:puppet:puppet:2.7.5:*:*:*:*:*:*:*
puppetpuppet2.7.6cpe:2.3:a:puppet:puppet:2.7.6:*:*:*:*:*:*:*
puppetpuppet2.7.8cpe:2.3:a:puppet:puppet:2.7.8:*:*:*:*:*:*:*
puppetpuppet2.7.9cpe:2.3:a:puppet:puppet:2.7.9:*:*:*:*:*:*:*
puppetpuppet2.7.10cpe:2.3:a:puppet:puppet:2.7.10:*:*:*:*:*:*:*
puppetpuppet2.7.11cpe:2.3:a:puppet:puppet:2.7.11:*:*:*:*:*:*:*
puppetpuppet2.7.12cpe:2.3:a:puppet:puppet:2.7.12:*:*:*:*:*:*:*
puppetlabspuppet2.7.0cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
puppet	puppet	2.7.3	cpe:2.3:a:puppet:puppet:2.7.3:::::::*
puppet	puppet	2.7.4	cpe:2.3:a:puppet:puppet:2.7.4:::::::*
puppet	puppet	2.7.5	cpe:2.3:a:puppet:puppet:2.7.5:::::::*
puppet	puppet	2.7.6	cpe:2.3:a:puppet:puppet:2.7.6:::::::*
puppet	puppet	2.7.8	cpe:2.3:a:puppet:puppet:2.7.8:::::::*
puppet	puppet	2.7.9	cpe:2.3:a:puppet:puppet:2.7.9:::::::*
puppet	puppet	2.7.10	cpe:2.3:a:puppet:puppet:2.7.10:::::::*
puppet	puppet	2.7.11	cpe:2.3:a:puppet:puppet:2.7.11:::::::*
puppet	puppet	2.7.12	cpe:2.3:a:puppet:puppet:2.7.12:::::::*
puppetlabs	puppet	2.7.0	cpe:2.3:a:puppetlabs:puppet:2.7.0:::::::*