Lucene search

K
freebsdFreeBSD36235C38-E0A8-11E1-9F4D-002354ED89BC
HistoryJul 09, 2012 - 12:00 a.m.

automake -- Insecure 'distcheck' recipe granted world-writable distdir

2012-07-0900:00:00
vuxml.freebsd.org
4

4.4 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

5.3%

GNU reports:

The recipe of the ‘distcheck’ target granted temporary
world-write permissions on the extracted distdir. This introduced
a locally exploitable race condition for those who run “make
distcheck” with a non-restrictive umask (e.g., 022) in a directory
that was accessible by others. A successful exploit would result
in arbitrary code execution with the privileges of the user
running “make distcheck”.
It is important to stress that this vulnerability impacts not only
the Automake package itself, but all packages with
Automake-generated makefiles. For an effective fix it is necessary
to regenerate the Makefile.in files with a fixed Automake
version.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchautomake= 1.5.0UNKNOWN
FreeBSDanynoarchautomake< 1.12.2UNKNOWN

4.4 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

5.3%