Lucene search

AmazonALAS-2014-401

HistorySep 17, 2014 - 9:41 p.m.

Low: automake19

2014-09-1721:41:00

alas.aws.amazon.com

CVSS2

4.4

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

EPSS

Percentile

5.1%

JSON

Issue Overview:

It was found that the distcheck rule in Automake-generated Makefiles made a directory world-writable when preparing source archives. If a malicious, local user could access this directory, they could execute arbitrary code with the privileges of the user running “make distcheck”.

Affected Packages:

automake19

Issue Correction:
Run yum update automake19 to update your system.

New Packages:

noarch:  
    automake19-1.9.6-3.12.amzn1.noarch  
  
src:  
    automake19-1.9.6-3.12.amzn1.src

Additional References

Red Hat: CVE-2012-3386

Mitre: CVE-2012-3386

OSVersionArchitecturePackageVersionFilename
Amazon Linux1noarchautomake19< 1.9.6-3.12.amzn1automake19-1.9.6-3.12.amzn1.noarch.rpm

OS	Version	Architecture	Package	Version	Filename
Amazon Linux	1	noarch	automake19	< 1.9.6-3.12.amzn1	automake19-1.9.6-3.12.amzn1.noarch.rpm

CVSS2

4.4

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

EPSS

Percentile

5.1%

JSON

Related for ALAS-2014-401