Published: 07/08/2012 Updated: 13/02/2023

CVSS v2 Base Score: 4.4 | Impact Score: 6.4 | Exploitability Score: 3.4

VMScore: 392

Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P

The "make distcheck" rule in GNU Automake prior to 1.11.6 and 1.12.x prior to 1.12.2 grants world-writable permissions to the extraction directory, which introduces a race condition that allows local users to execute arbitrary code via unspecified vectors.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnu automake 1.5
gnu automake 1.10.1
gnu automake 1.4
gnu automake 1.10
gnu automake 1.7.8
gnu automake 1.9.2
gnu automake 1.8
gnu automake 1.11.1
gnu automake 1.3
gnu automake
gnu automake 1.6
gnu automake 1.6.1
gnu automake 1.11.4
gnu automake 1.2
gnu automake 1.10.0.3
gnu automake 1.7.5
gnu automake 1.7.6
gnu automake 1.6.2
gnu automake 1.7
gnu automake 1.7.3
gnu automake 1.9.6
gnu automake 1.11.3
gnu automake 1.10.2
gnu automake 1.8.2
gnu automake 1.9.5
gnu automake 1.8.5
gnu automake 1.8.3
gnu automake 1.7.1
gnu automake 1.11.2
gnu automake 1.9
gnu automake 1.9.1
gnu automake 1.7.4
gnu automake 1.7.7
gnu automake 1.12.1
gnu automake 1.7.2
gnu automake 1.9.3
gnu automake 1.0
gnu automake 1.12
gnu automake 1.6.3
gnu automake 1.10.3
gnu automake 1.9.4
gnu automake 1.8.1
gnu automake 1.8.4
gnu automake 1.7.9

Synopsis Low: automake security update Type/Severity Security Advisory: Low Topic An updated automake package that fixes one security issue is now availablefor Red Hat Enterprise Linux 6The Red Hat Security Response Team has rated this update as having lowsecurity impact A Common Vulnerability Scoring Sys ...

Debian Bug report logs - #681097 CVE-2012-3386: Information disclosure Package: automake; Maintainer for automake is Eric Dorland <eric@debianorg>; Source for automake is src:automake-116 (PTS, buildd, popcon) Reported by: Moritz Muehlenhoff <muehlenhoff@univentionde> Date: Tue, 10 Jul 2012 16:00:01 UTC Severity: ...

It was found that the distcheck rule in Automake-generated Makefiles made a directory world-writable when preparing source archives If a malicious, local user could access this directory, they could execute arbitrary code with the privileges of the user running "make distcheck" ...

CWE-264 CWE-362 https://lists.gnu.org/archive/html/automake/2012-07/msg00023.html http://www.mandriva.com/security/advisories?name=MDVSA-2012:103 http://git.savannah.gnu.org/cgit/automake.git/commit/?id=784b3e6ccc7c72a1c95c340cbbe8897d6b689d76 https://lists.gnu.org/archive/html/automake/2012-07/msg00022.html https://lists.gnu.org/archive/html/automake/2012-07/msg00021.html http://lists.opensuse.org/opensuse-updates/2012-11/msg00038.html http://rhn.redhat.com/errata/RHSA-2013-0526.html http://lists.fedoraproject.org/pipermail/package-announce/2012-September/087665.html http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089187.html http://lists.fedoraproject.org/pipermail/package-announce/2012-September/087538.html https://access.redhat.com/errata/RHSA-2013:0526 https://nvd.nist.gov https://alas.aws.amazon.com/ALAS-2014-401.html

CVE-2012-3386

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect