CVE-2012-1989: Puppet allows local users to overwrite arbitrary files via a symlink attack

The vulnerability description explicitly identifies telnet.rb as the source file and mentions the predictable log path /tmp/out.log. The root cause is the insecure handling of the log file path in the Telnet connection setup, which doesn't validate() if the file is a symlink. This matches common symlink attack patterns where predictable temporary file paths are used without proper safety checks. The affected versions' patch (2.7.13) likely added symlink checks or randomized log paths, but the exact function isn't named in available documentation.