This is a known issue with PulledPork:
http://code.google.com/p/pulledpork/issues/detail?id=68

Per Comment 2 in the above link, I modified pulledpork.pl as follows:

elsif ( $base_url =~ /emergingthreats.net/ ) {
                my $Snortv = $Snort;
                $Snortv =~ s/(?<=\d\.\d\.\d)\.\d//;
        # Do we want a tarball for Snort or Suricata?
        # If Snort, keep the default PP $base_url $oinkcode/snort-$Snortv
        # If Suricata, set $base_url to suricata $oinkcode/suricata
        my $Engine = `grep ENGINE /etc/nsm/securityonion.conf | cut -d\= -f2`;
        chomp $Engine;
        if ( $Engine eq "snort" ) {
                    $base_url .= "$oinkcode/snort-$Snortv/";
        }
        elsif ( $Engine eq "suricata" ) {
            $base_url .= "$oinkcode/suricata/";
        }
        else {
            croak("Unknown ENGINE in /etc/nsm/securityonion.conf");
        }
                #$Textonly = 1;
            }

Created securityonion-pulledpork_20111127_i386.deb as follows:
/var/lib/gems/1.8/bin/fpm -s dir -t deb -n securityonion-pulledpork -v 20111127 
/usr/local/bin/pulledpork.pl

Published:
http://securityonion.blogspot.com/2011/11/security-onion-20111127-now-available.
html