CVE:CVE-2010-0156
CNNVD:CNNVD-201003-034
Puppet是一种开源的自动化系统配置管理工具，利用它IT组织可以对配置服务进行编码，从而形成一种管理规则，随后系统框架会对其进行审查并强制实施。
Puppet 存在任意文件覆盖漏洞。本地攻击者可以借助(1) /tmp/daemonout、(2) /tmp/puppetdoc.txt、 (3) /tmp/puppetdoc.tex、 或 (4) /tmp/puppetdoc.aux 临时文件的符号链接攻击，导致任意文件覆盖。
solution:Upgrade puppet puppet to a higher version than 0.24.3,0.24.4,0.24.5,0.24.6,0.24.6:rc1,0.24.6:rc2,0.24.7,0.24.7:rc2,0.24.8,0.24.8:rc1,0.25.0,0.25.0:beta1,0.25.0:beta2,0.25.0:rc1,0.25.1,0.25.1:rc1,0.25.1:rc2,0.25.2:rc1,0.25.2:rc2,0.25.2:rc3,and avoid the version 0.24.3,0.24.4,0.24.5,0.24.6,0.24.6:rc1,0.24.6:rc2,0.24.7,0.24.7:rc2,0.24.8,0.24.8:rc1,0.25.0,0.25.0:beta1,0.25.0:beta2,0.25.0:rc1,0.25.1,0.25.1:rc1,0.25.1:rc2,0.25.2:rc1,0.25.2:rc2,0.25.2:rc3