CVE-2012-3386

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

The "make distcheck" rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world-writable permissions to the extraction directory, which introduces a race condition that allows local users to execute arbitrary code via unspecified vectors.

References

http://git.savannah.gnu.org/cgit/automake.git/commit/?id=784b3e6ccc7c72a1c95c340cbbe8897d6b689d76

http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089187.html

http://lists.fedoraproject.org/pipermail/package-announce/2012-September/087538.html

http://lists.fedoraproject.org/pipermail/package-announce/2012-September/087665.html

http://lists.opensuse.org/opensuse-updates/2012-11/msg00038.html

http://rhn.redhat.com/errata/RHSA-2013-0526.html

http://www.mandriva.com/security/advisories?name=MDVSA-2012:103

https://lists.gnu.org/archive/html/automake/2012-07/msg00021.html

https://lists.gnu.org/archive/html/automake/2012-07/msg00022.html

https://lists.gnu.org/archive/html/automake/2012-07/msg00023.html

Details

Source: MITRE

Published: 2012-08-07

Updated: 2013-04-05

Type: CWE-264

Risk Information

CVSS v2

Base Score: 4.4

Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 3.4

Severity: MEDIUM

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:gnu:automake:1.0:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.2:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.3:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.4:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.4:p1:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.4:p2:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.4:p3:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.4:p4:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.4:p5:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.4:p6:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.5:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.6:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.6.1:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.6.2:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.6.3:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.7:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.7.1:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.7.2:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.7.3:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.7.4:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.7.5:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.7.6:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.7.7:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.7.8:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.7.9:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.8:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.8.1:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.8.2:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.8.3:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.8.4:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.8.5:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.9:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.9.1:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.9.2:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.9.3:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.9.4:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.9.5:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.9.6:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.10:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.10.0.3:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.10.1:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.10.2:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.10.3:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.11.1:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.11.2:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.11.3:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.11.4:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:*:*:*:*:*:*:*:* versions up to 1.11.5 (inclusive)

cpe:2.3:a:gnu:automake:1.12:*:*:*:*:*:*:*

cpe:2.3:a:gnu:automake:1.12.1:*:*:*:*:*:*:*

Tenable Plugins

View all (22 total)

IDNameProductFamilySeverity
78344Amazon Linux AMI : automake19 (ALAS-2014-401)NessusAmazon Linux Local Security Checks
medium
77990CentOS 5 : automake (CESA-2014:1243)NessusCentOS Local Security Checks
medium
77954Scientific Linux Security Update : automake on SL5.x (noarch) (20140916)NessusScientific Linux Local Security Checks
medium
77736Oracle Linux 5 : automake (ELSA-2014-1243)NessusOracle Linux Local Security Checks
medium
77696RHEL 5 : automake (RHSA-2014:1243)NessusRed Hat Local Security Checks
medium
74814openSUSE Security Update : automake (openSUSE-SU-2012:1519-1)NessusSuSE Local Security Checks
medium
70650GLSA-201310-15 : GNU Automake: Multiple vulnerabilitiesNessusGentoo Local Security Checks
medium
69345SuSE 11.2 / 11.3 Security Update : automake (SAT Patch Numbers 8196 / 8197)NessusSuSE Local Security Checks
medium
68761Oracle Linux 6 : automake (ELSA-2013-0526)NessusOracle Linux Local Security Checks
medium
66045Mandriva Linux Security Advisory : automake (MDVSA-2013:031)NessusMandriva Local Security Checks
medium
65156CentOS 6 : automake (CESA-2013:0526)NessusCentOS Local Security Checks
medium
64947Scientific Linux Security Update : automake on SL6.x (noarch) (20130221)NessusScientific Linux Local Security Checks
medium
64772RHEL 6 : automake (RHSA-2013:0526)NessusRed Hat Local Security Checks
medium
62421Fedora 16 : automake17-1.7.9-15.fc16 (2012-14779)NessusFedora Local Security Checks
medium
62420Fedora 17 : automake17-1.7.9-16.fc17 (2012-14770)NessusFedora Local Security Checks
medium
62419Fedora 18 : automake17-1.7.9-17.fc18 (2012-14762)NessusFedora Local Security Checks
medium
62231Fedora 16 : automake-1.11.6-1.fc16 (2012-14297)NessusFedora Local Security Checks
medium
62193Fedora 17 : automake-1.11.6-1.fc17 (2012-14349)NessusFedora Local Security Checks
medium
61957Mandriva Linux Security Advisory : automake (MDVSA-2012:103)NessusMandriva Local Security Checks
medium
61451FreeBSD : automake -- Insecure 'distcheck' recipe granted world-writable distdir (36235c38-e0a8-11e1-9f4d-002354ed89bc)NessusFreeBSD Local Security Checks
medium
61444FreeBSD : automake -- Insecure 'distcheck' recipe granted world-writable distdir (10f38033-e006-11e1-9304-000000000000)NessusFreeBSD Local Security Checks
high
60112Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / 8.1 / 9.0 / 9.1 / current : libpng (SSA:2012-206-01)NessusSlackware Local Security Checks
medium