GNU Automake Insecure Directory Permissions Vulnerability
BID:37378
Info
GNU Automake Insecure Directory Permissions Vulnerability
| Bugtraq ID: | 37378 |
| Class: | Race Condition Error |
| CVE: |
CVE-2009-4029 |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 08 2009 12:00AM |
| Updated: | Apr 13 2015 09:40PM |
| Credit: | Jim Meyering, Red Hat |
| Vulnerable: |
Sun OpenSolaris svn_126 Sun OpenSolaris build snv_99 Sun OpenSolaris build snv_98 Sun OpenSolaris build snv_96 Sun OpenSolaris build snv_95 Sun OpenSolaris build snv_94 Sun OpenSolaris build snv_93 Sun OpenSolaris build snv_92 Sun OpenSolaris build snv_91 Sun OpenSolaris build snv_90 Sun OpenSolaris build snv_89 Sun OpenSolaris build snv_88 Sun OpenSolaris build snv_87 Sun OpenSolaris build snv_86 Sun OpenSolaris build snv_85 Sun OpenSolaris build snv_84 Sun OpenSolaris build snv_83 Sun OpenSolaris build snv_82 Sun OpenSolaris build snv_81 Sun OpenSolaris build snv_80 Sun OpenSolaris build snv_78 Sun OpenSolaris build snv_77 Sun OpenSolaris build snv_76 Sun OpenSolaris build snv_71 Sun OpenSolaris build snv_131 Sun OpenSolaris build snv_130 Sun OpenSolaris build snv_129 Sun OpenSolaris build snv_128 Sun OpenSolaris build snv_127 Sun OpenSolaris build snv_126 Sun OpenSolaris build snv_125 Sun OpenSolaris build snv_124 Sun OpenSolaris build snv_123 Sun OpenSolaris build snv_122 Sun OpenSolaris build snv_121 Sun OpenSolaris build snv_120 Sun OpenSolaris build snv_119 Sun OpenSolaris build snv_118 Sun OpenSolaris build snv_117 Sun OpenSolaris build snv_116 Sun OpenSolaris build snv_115 Sun OpenSolaris build snv_114 Sun OpenSolaris build snv_113 Sun OpenSolaris build snv_112 Sun OpenSolaris build snv_111a Sun OpenSolaris build snv_111 Sun OpenSolaris build snv_110 Sun OpenSolaris build snv_109 Sun OpenSolaris build snv_108 Sun OpenSolaris build snv_107 Sun OpenSolaris build snv_106 Sun OpenSolaris build snv_105 Sun OpenSolaris build snv_104 Sun OpenSolaris build snv_103 Sun OpenSolaris build snv_102 Sun OpenSolaris build snv_101a Sun OpenSolaris build snv_101 Sun OpenSolaris build snv_100 rPath rPath Linux 2 Redhat Enterprise Linux Desktop Workstation 5 client Redhat Enterprise Linux 5 Server Pardus Linux 2009 0 Mandriva Linux Mandrake 2010.1 x86_64 Mandriva Linux Mandrake 2010.1 Mandriva Linux Mandrake 2010.0 x86_64 Mandriva Linux Mandrake 2010.0 Mandriva Linux Mandrake 2009.1 x86_64 Mandriva Linux Mandrake 2009.1 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 4.0 GNU m4 1.4.13 GNU m4 1.4.11 GNU m4 1.4.10 GNU m4 0 GNU Automake 1.10.2 GNU Automake 1.8.3 GNU Automake 1.8.2 GNU Automake 1.8.1 GNU Automake 1.7.9 GNU Automake 1.7.8 GNU Automake 1.7.7 GNU Automake 1.7.6 GNU Automake 1.7.5 GNU Automake 1.7.4 GNU Automake 1.7.3 GNU Automake 1.7.2 GNU Automake 1.7.1 GNU Automake 1.7 GNU Automake 1.11 Gentoo Linux |
| Not Vulnerable: |
GNU m4 1.4.14 GNU Automake 1.11.1 GNU Automake 1.10.3 |
Discussion
GNU Automake Insecure Directory Permissions Vulnerability
GNU Automake creates directories with insecure permissions.
An attacker can exploit this issue to modify distribution files, which could potentially allow the attacker to run arbitrary code.
Versions prior to Automake 1.10.3 and 1.11.1 are affected.
GNU Automake creates directories with insecure permissions.
An attacker can exploit this issue to modify distribution files, which could potentially allow the attacker to run arbitrary code.
Versions prior to Automake 1.10.3 and 1.11.1 are affected.
Exploit / POC
GNU Automake Insecure Directory Permissions Vulnerability
Attackers can use readily available tools and standard commands to exploit this issue.
Attackers can use readily available tools and standard commands to exploit this issue.
Solution / Fix
GNU Automake Insecure Directory Permissions Vulnerability
Solution:
Updates are available. Please see the references for more information.
Mandriva Linux Mandrake 2010.1 x86_64
Mandriva Linux Mandrake 2010.0
Mandriva Linux Mandrake 2009.0 x86_64
Mandriva Linux Mandrake 2009.1
Mandriva Linux Mandrake 2009.1 x86_64
MandrakeSoft Enterprise Server 5 x86_64
GNU m4 0
MandrakeSoft Enterprise Server 5
Mandriva Linux Mandrake 2010.0 x86_64
Mandriva Linux Mandrake 2010.1
Mandriva Linux Mandrake 2009.0
GNU m4 1.4.10
GNU m4 1.4.11
GNU m4 1.4.13
Solution:
Updates are available. Please see the references for more information.
Mandriva Linux Mandrake 2010.1 x86_64
-
Mandriva automake1.4-1.4.0.p6-6.1mdv2010.1.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva automake1.7-1.7.9-10.1mdv2010.1.noarch.rpm
http://www.mandriva.com/en/download/
Mandriva Linux Mandrake 2010.0
-
Mandriva automake-1.11-2.1mdv2010.0.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva automake1.4-1.4.0.p6-5.1mdv2010.0.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva automake1.7-1.7.9-9.1mdv2010.0.noarch.rpm
http://www.mandriva.com/en/download/
Mandriva Linux Mandrake 2009.0 x86_64
-
Mandriva automake-1.10.1-2.1mdv2009.0.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva automake1.4-1.4.0.p6-4.1mdv2009.0.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva automake1.7-1.7.9-7.1mdv2009.0.noarch.rpm
http://www.mandriva.com/en/download/
Mandriva Linux Mandrake 2009.1
-
Mandriva automake-1.10.2-2.1mdv2009.1.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva automake1.4-1.4.0.p6-4.1mdv2009.1.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva automake1.7-1.7.9-8.1mdv2009.1.noarch.rpm
http://www.mandriva.com/en/download/
Mandriva Linux Mandrake 2009.1 x86_64
-
Mandriva automake-1.10.2-2.1mdv2009.1.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva automake1.4-1.4.0.p6-4.1mdv2009.1.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva automake1.7-1.7.9-8.1mdv2009.1.noarch.rpm
http://www.mandriva.com/en/download/
MandrakeSoft Enterprise Server 5 x86_64
-
Mandriva automake-1.10.1-2.1mdvmes5.1.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva automake1.4-1.4.0.p6-4.1mdvmes5.1.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva automake1.7-1.7.9-7.1mdvmes5.1.noarch.rpm
http://www.mandriva.com/en/download/
GNU m4 0
-
GNU m4-1.4.14.tar.gz
http://ftp.gnu.org/gnu/m4/m4-1.4.14.tar.gz
MandrakeSoft Enterprise Server 5
-
Mandriva automake-1.10.1-2.1mdvmes5.1.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva automake1.4-1.4.0.p6-4.1mdvmes5.1.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva automake1.7-1.7.9-7.1mdvmes5.1.noarch.rpm
http://www.mandriva.com/en/download/
Mandriva Linux Mandrake 2010.0 x86_64
-
Mandriva automake-1.11-2.1mdv2010.0.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva automake1.4-1.4.0.p6-5.1mdv2010.0.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva automake1.7-1.7.9-9.1mdv2010.0.noarch.rpm
http://www.mandriva.com/en/download/
Mandriva Linux Mandrake 2010.1
-
Mandriva automake1.4-1.4.0.p6-6.1mdv2010.1.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva automake1.7-1.7.9-10.1mdv2010.1.noarch.rpm
http://www.mandriva.com/en/download/
Mandriva Linux Mandrake 2009.0
-
Mandriva automake-1.10.1-2.1mdv2009.0.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva automake1.4-1.4.0.p6-4.1mdv2009.0.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva automake1.7-1.7.9-7.1mdv2009.0.noarch.rpm
http://www.mandriva.com/en/download/
GNU m4 1.4.10
-
GNU m4-1.4.14.tar.gz
http://ftp.gnu.org/gnu/m4/m4-1.4.14.tar.gz
GNU m4 1.4.11
-
GNU m4-1.4.14.tar.gz
http://ftp.gnu.org/gnu/m4/m4-1.4.14.tar.gz
GNU m4 1.4.13
-
GNU m4-1.4.14.tar.gz
http://ftp.gnu.org/gnu/m4/m4-1.4.14.tar.gz
References
GNU Automake Insecure Directory Permissions Vulnerability
References:
References:
- Automake Homepage (GNU)
- m4 Homepage (GNU)
- maintainer security fix (Eric Blake)
- Security fix by requiring newer automake features. (Eric Blake)
- A Race Condition Security Vulnerability in the OpenSolaris "automake" Utility ma (Sun Microsystems)
- CVE-2009-4029 Automake security fix for 'make dist*' (Ralf Wildenhues)