CVE-2010-0156

Puppet 0.24.x before 0.24.9 and 0.25.x before 0.25.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/daemonout, (2) /tmp/puppetdoc.txt, (3) /tmp/puppetdoc.tex, or (4) /tmp/puppetdoc.aux temporary file.

CVSS v2.0 3.3 LOW

3.3^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:M/Au:N/C:N/I:P/A:P

Exploitability : 3.4 / Impact : 4.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://groups.google.com/group/puppet-announce/browse_thread/thread/4401823f6cbf6087	Patch
http://groups.google.com/group/puppet-announce/browse_thread/thread/73cd1b2896d986c2
http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036083.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036166.html
http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
http://secunia.com/advisories/38766	Patch Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=502881	Patch
https://puppet.com/security/cve/cve-2010-0156

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:puppet:puppet:0.24.3:::::::*
	cpe:2.3:a:puppet:puppet:0.24.4:::::::*
	cpe:2.3:a:puppet:puppet:0.24.5:::::::*
	cpe:2.3:a:puppet:puppet:0.24.6:::::::*
	cpe:2.3:a:puppet:puppet:0.24.6:rc1::::::
	cpe:2.3:a:puppet:puppet:0.24.6:rc2::::::
	cpe:2.3:a:puppet:puppet:0.24.7:::::::*
	cpe:2.3:a:puppet:puppet:0.24.7:rc2::::::
	cpe:2.3:a:puppet:puppet:0.24.8:::::::*
	cpe:2.3:a:puppet:puppet:0.24.8:rc1::::::
	cpe:2.3:a:puppet:puppet:0.25.0:::::::*
	cpe:2.3:a:puppet:puppet:0.25.0:beta1::::::
	cpe:2.3:a:puppet:puppet:0.25.0:beta2::::::
	cpe:2.3:a:puppet:puppet:0.25.0:rc1::::::
	cpe:2.3:a:puppet:puppet:0.25.1:::::::*
	cpe:2.3:a:puppet:puppet:0.25.1:rc1::::::
	cpe:2.3:a:puppet:puppet:0.25.1:rc2::::::
	cpe:2.3:a:puppet:puppet:0.25.2:rc1::::::
	cpe:2.3:a:puppet:puppet:0.25.2:rc2::::::
	cpe:2.3:a:puppet:puppet:0.25.2:rc3::::::

History

No history.

Information

Published : 2010-03-03 19:30

Updated : 2017-12-09 02:29

NVD link : CVE-2010-0156

Mitre link : CVE-2010-0156

CVE.ORG link : CVE-2010-0156

JSON object : View

Products Affected

puppet

puppet

CWE

CWE-59

Improper Link Resolution Before File Access ('Link Following')

{"id": "CVE-2010-0156", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.3, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2010-03-03T19:30:00.447", "references": [{"url": "http://groups.google.com/group/puppet-announce/browse_thread/thread/4401823f6cbf6087", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://groups.google.com/group/puppet-announce/browse_thread/thread/73cd1b2896d986c2", "source": "cve@mitre.org"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036083.html", "source": "cve@mitre.org"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036166.html", "source": "cve@mitre.org"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/38766", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=502881", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://puppet.com/security/cve/cve-2010-0156", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-59"}]}], "descriptions": [{"lang": "en", "value": "Puppet 0.24.x before 0.24.9 and 0.25.x before 0.25.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/daemonout, (2) /tmp/puppetdoc.txt, (3) /tmp/puppetdoc.tex, or (4) /tmp/puppetdoc.aux temporary file."}, {"lang": "es", "value": "Puppet 0.24.x en versiones anteriores a la 0.24.9 y 0.25.x en versiones anteriores a la 0.25.2 permite a atacantes locales sobrescribir ficheros de su elecci\u00f3n mediante un ataque de enlace simb\u00f3lico (symlink) en el fichero temporal (1) /tmp/daemonout, (2) /tmp/puppetdoc.txt, (3) /tmp/puppetdoc.tex o (4) /tmp/puppetdoc.aux."}], "lastModified": "2017-12-09T02:29:00.403", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:puppet:puppet:0.24.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F0C04313-1D0B-42A5-95D3-0993B290073E"}, {"criteria": "cpe:2.3:a:puppet:puppet:0.24.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "670B5AB8-5F6A-43F4-B1A3-42F041D18436"}, {"criteria": "cpe:2.3:a:puppet:puppet:0.24.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D67D1460-9530-4747-8D0D-E59A0BEF60DC"}, {"criteria": "cpe:2.3:a:puppet:puppet:0.24.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64C04B29-6942-410D-9695-1E727DDB109E"}, {"criteria": "cpe:2.3:a:puppet:puppet:0.24.6:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CA12A441-261F-46E0-B22A-3E54325E13ED"}, {"criteria": "cpe:2.3:a:puppet:puppet:0.24.6:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D2CCD5F9-F757-4DD1-8236-182965290C85"}, {"criteria": "cpe:2.3:a:puppet:puppet:0.24.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "862C2179-B5E2-45F5-9F2C-3161C6C7F081"}, {"criteria": "cpe:2.3:a:puppet:puppet:0.24.7:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "72286F10-7B49-4BED-B0DF-20A006F103D3"}, {"criteria": "cpe:2.3:a:puppet:puppet:0.24.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "143D014E-3454-476B-8868-DB383B716B55"}, {"criteria": "cpe:2.3:a:puppet:puppet:0.24.8:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2EE099D4-6BE5-4142-8AA2-F4D5E4B7BA87"}, {"criteria": "cpe:2.3:a:puppet:puppet:0.25.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "52C34E71-CDCA-469E-85FD-316010553708"}, {"criteria": "cpe:2.3:a:puppet:puppet:0.25.0:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3AAF7D3D-AB39-4DE7-9532-5E4536E11A83"}, {"criteria": "cpe:2.3:a:puppet:puppet:0.25.0:beta2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D55E19D9-3BB5-4142-A730-C6F581C7FBA6"}, {"criteria": "cpe:2.3:a:puppet:puppet:0.25.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7B6780C8-A138-4470-A533-9C3A922B0A3C"}, {"criteria": "cpe:2.3:a:puppet:puppet:0.25.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CF3FF502-48C2-4836-8CBD-BBD82635D1A7"}, {"criteria": "cpe:2.3:a:puppet:puppet:0.25.1:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C31B9F0A-FE81-4140-9517-374B34016F22"}, {"criteria": "cpe:2.3:a:puppet:puppet:0.25.1:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "70AD7D56-2BA0-4B3A-9B4E-37A2393C5109"}, {"criteria": "cpe:2.3:a:puppet:puppet:0.25.2:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E187EA82-BFE4-486A-81D9-63277D9F2A3B"}, {"criteria": "cpe:2.3:a:puppet:puppet:0.25.2:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "54C2F856-E1A6-4B62-BCB3-F04AD44FBDCD"}, {"criteria": "cpe:2.3:a:puppet:puppet:0.25.2:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F6CAA9DE-80F9-46BE-871A-50E214D1F3B6"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}