PT-2009-6212 · Gnu+2 · Gnu Automake+2
Ralf Wildenhues
+1
·
Published
2009-12-20
·
Updated
2024-06-15
·
CVE-2009-4029
CVSS v2.0
4.4
Medium
| Vector | AV:L/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
GNU Automake versions 1.11.1, 1.10.3
GNU Automake release branches branch-1-4 through branch-1-9
Description
The issue in GNU Automake allows local users to introduce a race condition, enabling them to modify package files, introduce Trojan horse programs, or conduct other attacks before the build is complete. This is due to insecure permissions (777) being assigned to directories in the build tree when producing a distribution tarball for a package that uses Automake.
Recommendations
For GNU Automake versions 1.11.1 and 1.10.3, consider updating to a version that does not assign insecure permissions to directories in the build tree.
For GNU Automake release branches branch-1-4 through branch-1-9, consider updating to a version that does not assign insecure permissions to directories in the build tree.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gnu Automake
Red Hat
Suse