Local Privilege Escalation via Symlink Attack Affecting puppet package, versions <2.6.11 >=2.7.0, <2.7.5
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-PUPPET-20304
- published 28 Feb 2017
- disclosed 29 Sep 2011
- credit Ricky Zhou
Introduced: 29 Sep 2011
CVE-2011-3870 Open this link in a new tabHow to fix?
Upgrade puppet to version 2.6.11, 2.7.5 or higher.
Overview
puppet is an automated configuration management tool.
Affected versions of the package are vulnerable to Symlink Attack via a user's SSH authorized_keys field. A TOCTOU (time-of-check-to-time-of-use) race vulnerability was present in the ssh_authorized_key type. When the target file and directory did not exist, each of them would be created as root and later chowned to the user. This made it possible to replace either one with a symlink to an arbitrary file, which would then become owned by that user. This would allow local privilege escalation to root through standard TOCTOU attack techniques.