PT-2012-1086 · Gnu+3 · Automake+3

Stefano Lattarini · Published 2012-08-07 · Updated 2024-06-15 · CVE-2012-3386

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GNU Automake versions prior to 1.11.6 GNU Automake versions 1.12.x prior to 1.12.2 automake version 1.9.6

Description The issue allows local users to execute arbitrary code via unspecified vectors due to a race condition introduced by world-writable permissions to the extraction directory. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be carried out locally.

Recommendations For GNU Automake versions prior to 1.11.6, update to version 1.11.6 or later. For GNU Automake versions 1.12.x prior to 1.12.2, update to version 1.12.2 or later. For automake version 1.9.6, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the make distcheck rule to minimize the risk of exploitation.

Exploit

Race Condition

Weakness Enumeration

CWE-362

CWE-264

Related Identifiers

BDU:2015-06708

BDU:2015-08866

CESA-2013_0526

CVE-2012-3386

OPENSUSE-SU-2022:10031-1

OPENSUSE-SU-2024:10184-1

OPENSUSE-SU-2024:10293-1

OPENSUSE-SU-2024:10576-1

RHSA-2013:0526

RHSA-2013_0526

RHSA-2014:1243

RHSA-2014_1243

Affected Products

Automake

Centos

Red Hat

Suse

References · 37

• 🔥 http://git.savannah.gnu.org/cgit/automake.git/commit/?id=784b3e6ccc7c72a1c95c340cbbe8897d6b689d76 · Exploit
• https://lists.gnu.org/archive/html/automake/2012-07/msg00023.html · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-3386 · Vendor Advisory
• https://lists.gnu.org/archive/html/automake/2012-07/msg00022.html · Patch
• https://security-tracker.debian.org/tracker/CVE-2012-3386 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2012-September/087538.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-3386 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08866 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-3386 · Security Note
• https://lists.gnu.org/archive/html/automake/2012-07/msg00021.html · Patch
• http://mandriva.com/security/advisories?name=MDVSA-2012:103 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089187.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06708 · Security Note
• https://linux.oracle.com/errata/ELSA-2013-0526.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3386 · Security Note