Permissions, Privileges, and Access Controls in Automake - CVE-2012-3386

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU32693

Permissions, Privileges, and Access Controls in Automake - CVE-2012-3386

Published: August 8, 2012 / Updated: July 28, 2020


Vulnerability identifier: #VU32693
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2012-3386
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local non-authenticated attacker to read and manipulate data.

The "make distcheck" rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world-writable permissions to the extraction directory, which introduces a race condition that allows local users to execute arbitrary code via unspecified vectors.


Affected software

Automake
Gentoo Linux
Amazon Linux AMI
Slackware Linux
libpng (Alpine package)
automake (Alpine package)

How to mitigate CVE-2012-3386

Install update from vendor's website.

libpng (Alpine package) - update to 1.4.12-r0
automake (Alpine package) - update to 1.11.1-r1

External References

Related Security Bulletins