CVE-2010-0156: Low severity puppet Puppet vulnerability
Description of problem: I noticed that puppet may create several predictable files in /tmp, e.g.
/tmp/daemonout /tmp/puppetdoc.txt /tmp/puppetdoc.tex
There are also a lot more in the tests, but they may not be run in Fedora's F10 spec, and even more in the puppet source, e.g. for the dmg installation provider.
Version-Release number of selected component (if applicable): puppet-0.24.8-1.fc10
How reproducible: always
Steps to Reproduce: 1. grep -nR /tmp/ /usr/lib/ruby/siteruby/1.8/puppet
Actual results: Contains ruby code like: /usr/lib/ruby/siteruby/1.8/puppet/daemon.rb:33: File.open("/tmp/daemonout", "w") { |f|
Expected results: Should only report findings that are not executed, e.g. in comments or help information
Additional info: Current git seems to contain even more issues, e.g. lib/puppet/network/server.rb:25: File.open("/tmp/daemonout", "w") { |f|
Other sources
Puppet 0.24.x before 0.24.9 and 0.25.x before 0.25.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/daemonout, (2) /tmp/puppetdoc.txt, (3) /tmp/puppetdoc.tex, or (4) /tmp/puppetdoc.aux temporary file.
— GitHub
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-0156?
CVE-2010-0156 has a moderate severity rating due to its potential for local file manipulation.
How do I fix CVE-2010-0156?
To fix CVE-2010-0156, upgrade to Puppet version 0.25.2 or later.
What versions are affected by CVE-2010-0156?
CVE-2010-0156 affects Puppet versions from 0.24.0 to 0.25.1.
Can CVE-2010-0156 lead to data leakage?
Yes, CVE-2010-0156 can potentially allow unauthorized access to files in the /tmp directory.
Is CVE-2010-0156 applicable to both Red Hat and RubyGems?
Yes, CVE-2010-0156 affects both the Red Hat package and RubyGems distributions of Puppet.