CVE:CVE-2011-3870
CNNVD:CNNVD-201110-658
Puppet 2.7.5之前的2.7.x版本，2.6.11之前的2.6.x版本和0.25.x版本中存在漏洞。本地用户可借助对SSH authorized_keys文件符号链接的攻击修改任意文件权限。
solution:Upgrade puppet puppet to a higher version than 2.6.0,2.6.1,2.6.2,2.6.3,2.6.4,2.6.5,2.6.6,2.6.7,2.6.8,2.6.9,2.6.10,2.7.2,2.7.3,2.7.4,0.25.0,0.25.1,0.25.2,0.25.3,0.25.4,0.25.5,0.25.6,and avoid the version 2.6.0,2.6.1,2.6.2,2.6.3,2.6.4,2.6.5,2.6.6,2.6.7,2.6.8,2.6.9,2.6.10,2.7.2,2.7.3,2.7.4,0.25.0,0.25.1,0.25.2,0.25.3,0.25.4,0.25.5,0.25.6; Upgrade puppetlabs puppet to a higher version than 2.7.0,2.7.1,and avoid the version 2.7.0,2.7.1