PT-2012-1086 · Gnu+3 · Automake+3
Stefano Lattarini
·
Publicado
2012-08-07
·
Atualizado
2024-06-15
·
CVE-2012-3386
CVSS v2.0
4.4
Média
| Vetor | AV:L/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
GNU Automake versions prior to 1.11.6
GNU Automake versions 1.12.x prior to 1.12.2
automake version 1.9.6
Description
The issue allows local users to execute arbitrary code via unspecified vectors due to a race condition introduced by world-writable permissions to the extraction directory. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be carried out locally.
Recommendations
For GNU Automake versions prior to 1.11.6, update to version 1.11.6 or later.
For GNU Automake versions 1.12.x prior to 1.12.2, update to version 1.12.2 or later.
For automake version 1.9.6, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the
make distcheck rule to minimize the risk of exploitation.Exploit
Race Condition
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Automake
Centos
Red Hat
Suse