Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2012-1906

Date: May 29, 2012

Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.

Language: Ruby

Severity Score

Related Resources (13)

http://secunia.com/advisories/48789
https://exchange.xforce.ibmcloud.com/vulnerabilities/74793
https://people.canonical.com/~ubuntu-security/cve/CVE-2012-1906
http://projects.puppetlabs.com/issues/13260
http://secunia.com/advisories/48748
http://www.securityfocus.com/bid/52975
https://security-tracker.debian.org/tracker/CVE-2012-1906
http://www.debian.org/security/2012/dsa-2451
https://nvd.nist.gov/vuln/detail/CVE-2012-1906
http://puppetlabs.com/security/cve/cve-2012-1906/
http://ubuntu.com/usn/usn-1419-1
http://secunia.com/advisories/48743
https://www.mend.io/vulnerability-database/CVE-2012-1906

Severity Score

Weakness Type (CWE)

Permissions, Privileges, and Access Control

CWE-264

CVSS v3

Base Score:
Attack Vector (AV):
Attack Complexity (AC):
Privileges Required (PR):
User Interaction (UI):
Scope (S):
Confidentiality (C): PARTIAL
Integrity (I): PARTIAL
Availability (A): PARTIAL

CVSS v2

Base Score:
Access Vector (AV):
Access Complexity (AC):
Authentication (AU):
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): LOW
Additional information:

Do you need more information?

Contact Us