CVE-2012-3386 The "make distcheck" rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world-writable permissions to the extraction directory, which introduces a race condition that allows local user...
MediumCVSS 4.4
EPSS 0.47%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The "make distcheck" rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world-writable permissions to the extraction directory, which introduces a race condition that allows local users to execute arbitrary code via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/automake(Debian:14) | < 1:1.4-p6-13.1 | 1:1.4-p6-13.1 |
| debian/automake(Debian:14) | = 1.0-0 | No fix listed |
| debian/automake(Debian:14) | = 1.0-1 | No fix listed |
| debian/automake(Debian:14) | = 1.0-4 | No fix listed |
| debian/automake(Debian:14) | = 1.3-1 | No fix listed |
| debian/automake(Debian:14) | = 1.3-2 | No fix listed |
| debian/automake(Debian:14) | = 1.4-8 | No fix listed |
| debian/automake(Debian:14) | = 1:1.4-p4-1.1 | No fix listed |
| debian/automake(Debian:14) | = 1:1.4-p6-10 | No fix listed |
| debian/automake(Debian:14) | = 1:1.4-p6-11 | No fix listed |
| debian/automake(Debian:14) | = 1:1.4-p6-12 | No fix listed |
| debian/automake(Debian:14) | = 1:1.4-p6-13 | No fix listed |
| debian/automake(Debian:14) | = 1:1.4-p6-9 | No fix listed |
| debian/automake1.11(Debian:12) | < 1:1.11.6-1 | 1:1.11.6-1 |
| GNU automake | <= 1.11.5 | No fix listed |
| GNU automake | = 1.0 | No fix listed |
| GNU automake | = 1.2 | No fix listed |
| GNU automake | = 1.3 | No fix listed |
| GNU automake | = 1.4 | No fix listed |
| GNU automake | = 1.4-p1 | No fix listed |
| GNU automake | = 1.4-p2 | No fix listed |
| GNU automake | = 1.4-p3 | No fix listed |
| GNU automake | = 1.4-p4 | No fix listed |
| GNU automake | = 1.4-p5 | No fix listed |
| GNU automake | = 1.4-p6 | No fix listed |
Show 39 more
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU automake | = 1.5 | No fix listed |
| GNU automake | = 1.6 | No fix listed |
| GNU automake | = 1.6.1 | No fix listed |
| GNU automake | = 1.6.2 | No fix listed |
| GNU automake | = 1.6.3 | No fix listed |
| GNU automake | = 1.7 | No fix listed |
| GNU automake | = 1.7.1 | No fix listed |
| GNU automake | = 1.7.2 | No fix listed |
| GNU automake | = 1.7.3 | No fix listed |
| GNU automake | = 1.7.4 | No fix listed |
| GNU automake | = 1.7.5 | No fix listed |
| GNU automake | = 1.7.6 | No fix listed |
| GNU automake | = 1.7.7 | No fix listed |
| GNU automake | = 1.7.8 | No fix listed |
| GNU automake | = 1.7.9 | No fix listed |
| GNU automake | = 1.8 | No fix listed |
| GNU automake | = 1.8.1 | No fix listed |
| GNU automake | = 1.8.2 | No fix listed |
| GNU automake | = 1.8.3 | No fix listed |
| GNU automake | = 1.8.4 | No fix listed |
| GNU automake | = 1.8.5 | No fix listed |
| GNU automake | = 1.9 | No fix listed |
| GNU automake | = 1.9.1 | No fix listed |
| GNU automake | = 1.9.2 | No fix listed |
| GNU automake | = 1.9.3 | No fix listed |
| GNU automake | = 1.9.4 | No fix listed |
| GNU automake | = 1.9.5 | No fix listed |
| GNU automake | = 1.9.6 | No fix listed |
| GNU automake | = 1.10 | No fix listed |
| GNU automake | = 1.10.0.3 | No fix listed |
| GNU automake | = 1.10.1 | No fix listed |
| GNU automake | = 1.10.2 | No fix listed |
| GNU automake | = 1.10.3 | No fix listed |
| GNU automake | = 1.11.1 | No fix listed |
| GNU automake | = 1.11.2 | No fix listed |
| GNU automake | = 1.11.3 | No fix listed |
| GNU automake | = 1.11.4 | No fix listed |
| GNU automake | = 1.12 | No fix listed |
| GNU automake | = 1.12.1 | No fix listed |
References
- Debian Security Tracker CVE-2012-3386 vendor-advisory
- git.savannah.gnu.org exploit patch
- FEDORA-2012-14770 vendor-advisory
- FEDORA-2012-14349 vendor-advisory
- FEDORA-2012-14297 vendor-advisory
- openSUSE-SU-2012:1519 vendor-advisory
- RHSA-2013:0526 vendor-advisory
- MDVSA-2012:103 vendor-advisory
- [automake] 20120709 GNU Automake 1.11.6 released (fixes a SECURITY VULNERABILITY!) mailing-list patch
- [automake] 20120709 GNU Automake 1.12.2 released (fixes a SECURITY VULNERABILITY!) mailing-list patch
- [automake] 20120709 CVE-2012-3386 Automake security fix for 'make distcheck' mailing-list patch
- bugs.debian.org issue-tracking