CVE ID:	CVE-2012-1054
Description:	Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a user login file with the k5login resource type, allows local users to gain privileges via a symlink attack on .k5login.
Test IDs:	1.3.6.1.4.1.25623.1.0.71147   1.3.6.1.4.1.25623.1.1.4.2012.0325.1
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2012-1054 BugTraq ID: 52158 http://www.securityfocus.com/bid/52158 Debian Security Information: DSA-2419 (Google Search) http://www.debian.org/security/2012/dsa-2419 http://projects.puppetlabs.com/issues/12460 http://www.osvdb.org/79496 http://secunia.com/advisories/48157 http://secunia.com/advisories/48161 http://secunia.com/advisories/48166 http://secunia.com/advisories/48290 SuSE Security Announcement: SUSE-SU-2012:0325 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html SuSE Security Announcement: openSUSE-SU-2012:0835 (Google Search) https://hermes.opensuse.org/messages/15087408 http://ubuntu.com/usn/usn-1372-1 XForce ISS Database: puppet-k5login-type-symlink(73446) https://exchange.xforce.ibmcloud.com/vulnerabilities/73446