CVE-2013-4969

Severity: low (CVSS 2.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-01-07 · updated 2026-06-16
Weakness: CWE-59

Description

Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files.

Affected products

Canonical Ubuntu Linux: 12.04, 12.10, 13.04, 13.10
Debian Linux: 6.0, 7.0, 8.0
Puppet Enterprise: from 2.0.0 before 2.8.4; from 3.1 before 3.1.1 — fixed in 2.8.4, 3.1.1
Puppetlabs Puppet: from 3.0.0 through 3.3.2; from 3.4.0 before 3.4.1 — fixed in 3.4.1

How to fix

Upgrade to a fixed version: Puppet Enterprise 2.8.4, 3.1.1; Puppetlabs Puppet 3.4.1. Check the vendor advisory for mitigations.

References

http://puppetlabs.com/security/cve/cve-2013-4969
http://secunia.com/advisories/56253
http://secunia.com/advisories/56254
http://www.debian.org/security/2013/dsa-2831
http://www.ubuntu.com/usn/USN-2077-1
http://puppetlabs.com/security/cve/cve-2013-4969
http://secunia.com/advisories/56253
http://secunia.com/advisories/56254
http://www.debian.org/security/2013/dsa-2831
http://www.ubuntu.com/usn/USN-2077-1

Get alerted when CVE-2013-4969 or the next vulnerability affects your stack