The (1) dist or (2) distcheck rules in GNU Automake 1.11.1, 1.10.3, and release branches branch-1-4 through branch-1-9, when producing a distribution tarball for a package that uses Automake, assign insecure permissions (777) to directories in the build tree, which introduces a race condition that allows local users to modify the contents of package files, introduce Trojan horse programs, or conduct other attacks before the build is complete.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2010-0321 advisory.

    [1.9.6-2.3]
    - increase delay in self checks
    - add delays in aclocal7 self check       http://osdir.com/ml/sysutils.automake.bugs/2006-09/msg00012.html
    - preserve timestamps of configure files

    [1.9.6-2.2]
    - add fix for CVE-2009-4029

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201412-08 (Multiple packages, Multiple vulnerabilities fixed in 2010)

    Vulnerabilities have been discovered in the packages listed below.
      Please review the CVE identifiers in the Reference section for details.
      Insight       Perl Tk Module       Source-Navigator       Tk       Partimage       Mlmmj       acl       Xinit       gzip       ncompress       liblzw       splashutils       GNU M4       KDE Display Manager       GTK+       KGet       dvipng       Beanstalk       Policy Mount       pam_krb5       GNU gv       LFTP       Uzbl       Slim       Bitdefender Console       iputils       DVBStreamer   Impact :

    A context-dependent attacker may be able to gain escalated privileges,       execute arbitrary code, cause Denial of Service, obtain sensitive       information, or otherwise bypass security restrictions.
  Workaround :

    There are no known workarounds at this time.

The remote host is affected by the vulnerability described in GLSA-201310-15 (GNU Automake: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in GNU Automake. Please       review the CVE identifiers referenced below for details.
  Impact :

    A local attacker could execute arbitrary commands with the privileges of       the user running an Automake-based build.
  Workaround :

    There is no known workaround at this time.

This update of automake fixes a race condition in 'distcheck'.
(CVE-2012-3386)

Also a bug where world writeable tarballs were generated during 'make dist' has been fixed. (CVE-2009-4029)

Automake-generated Makefiles made certain directories world-writable when preparing source archives, as was recommended by the GNU Coding Standards. If a malicious, local user could access the directory where a victim was creating distribution archives, they could use this flaw to modify the files being added to those archives. Makefiles generated by these updated automake packages no longer make distribution directories world-writable, as recommended by the updated GNU Coding Standards. (CVE-2009-4029)

Note: This issue affected Makefile targets used by developers to prepare distribution source archives. Those targets are not used when compiling programs from the source code.

A vulnerability was discovered and corrected in automake :

The (1) dist or (2) distcheck rules in GNU Automake 1.11.1, 1.10.3, and release branches branch-1-4 through branch-1-9, when producing a distribution tarball for a package that uses Automake, assign insecure permissions (777) to directories in the build tree, which introduces a race condition that allows local users to modify the contents of package files, introduce Trojan horse programs, or conduct other attacks before the build is complete (CVE-2009-4029).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated packages have been patched to correct this issue.

- Tue Feb 9 2010 Karsten Hopp <karsten at redhat.com>     1.4p6-20

    - add fix for CVE-2009-4029

    - Fri Jul 24 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1.4p6-19

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Tue Feb 16 2010 Karsten Hopp <karsten at redhat.com>     1.7.9-13.1

    - fix CVE-2009-4029

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Tue Feb 16 2010 Karsten Hopp <karsten at redhat.com>     1.7.9-13.1

    - fix CVE-2009-4029

    - Fri Jul 24 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1.7.9-13

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Tue Feb 16 2010 Karsten Hopp <karsten at redhat.com>     1.5-29.1

    - update CVE-2009-4029 patch

    - Tue Feb 9 2010 Karsten Hopp <karsten at redhat.com>       1.5-29

    - add disttag

    - Tue Feb 9 2010 Karsten Hopp <karsten at redhat.com>       1.5-28

    - add fix for CVE-2009-4029

    - add buildrequirement flex

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Tue Feb 16 2010 Karsten Hopp <karsten at redhat.com>     1.6.3-18.1

    - fix CVE-2009-4029

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Tue Feb 9 2010 Karsten Hopp <karsten at redhat.com>     1.4p6-20

    - add fix for CVE-2009-4029

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fixes CVE-2009-4029

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Tue Feb 16 2010 Karsten Hopp <karsten at redhat.com>     1.5-29.1

    - update CVE-2009-4029 patch

    - Tue Feb 9 2010 Karsten Hopp <karsten at redhat.com>       1.5-29

    - add disttag

    - Tue Feb 9 2010 Karsten Hopp <karsten at redhat.com>       1.5-28

    - add fix for CVE-2009-4029

    - add buildrequirement flex

    - Fri Jul 24 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1.5-27

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Tue Feb 16 2010 Karsten Hopp <karsten at redhat.com>     1.6.3-18.1

    - fix CVE-2009-4029

    - Fri Jul 31 2009 Karsten Hopp <karsten at redhat.com>       1.6.3-18

    - rebuild

    - Thu Jul 30 2009 Karsten Hopp <karsten at redhat.com>       1.6.3-17

    - fix build problem

    - Fri Jul 24 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1.6.3-16

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated automake, automake14, automake15, automake16, and automake17 packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Automake is a tool for automatically generating Makefile.in files compliant with the GNU Coding Standards.

Automake-generated Makefiles made certain directories world-writable when preparing source archives, as was recommended by the GNU Coding Standards. If a malicious, local user could access the directory where a victim was creating distribution archives, they could use this flaw to modify the files being added to those archives. Makefiles generated by these updated automake packages no longer make distribution directories world-writable, as recommended by the updated GNU Coding Standards. (CVE-2009-4029)

Note: This issue affected Makefile targets used by developers to prepare distribution source archives. Those targets are not used when compiling programs from the source code.

All users of automake, automake14, automake15, automake16, and automake17 should upgrade to these updated packages, which resolve this issue.

- Wed Dec 9 2009 Karsten Hopp <karsten at redhat.com>     1.11.1-1

    - update to version 1.11.1 to fix CVE-2009-4029

    - Tue Dec 1 2009 Karsten Hopp <karsten at redhat.com>       1.11-6

    - preserve time stamps of man pages (#225302)

    - drop MIT from list of licenses

    - Wed Nov 4 2009 Stepan Kasal <skasal at redhat.com> -       1.11-5

    - add even more testsuite build requires

    - Wed Nov 4 2009 Stepan Kasal <skasal at redhat.com> -       1.11-4

    - add build requires for testsuite

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
181061	Oracle Linux 5 : automake (ELSA-2010-0321)	Nessus	Oracle Linux Local Security Checks	high
79961	GLSA-201412-08 : Multiple packages, Multiple vulnerabilities fixed in 2010	Nessus	Gentoo Local Security Checks	critical
70650	GLSA-201310-15 : GNU Automake: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
69345	SuSE 11.2 / 11.3 Security Update : automake (SAT Patch Numbers 8196 / 8197)	Nessus	SuSE Local Security Checks	medium
60761	Scientific Linux Security Update : automake on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
49973	Mandriva Linux Security Advisory : automake (MDVSA-2010:203)	Nessus	Mandriva Local Security Checks	medium
47321	Fedora 11 : automake14-1.4p6-20.fc11 (2010-3591)	Nessus	Fedora Local Security Checks	medium
47319	Fedora 12 : automake17-1.7.9-13.fc12.1 (2010-3573)	Nessus	Fedora Local Security Checks	medium
47318	Fedora 11 : automake17-1.7.9-13.fc11.1 (2010-3569)	Nessus	Fedora Local Security Checks	medium
47317	Fedora 12 : automake15-1.5-29.fc12.1 (2010-3563)	Nessus	Fedora Local Security Checks	medium
47315	Fedora 12 : automake16-1.6.3-18.fc12.1 (2010-3520)	Nessus	Fedora Local Security Checks	medium
47265	Fedora 12 : automake14-1.4p6-20.fc12 (2010-1718)	Nessus	Fedora Local Security Checks	medium
47240	Fedora 11 : automake-1.11.1-1.fc11.1 (2010-1216)	Nessus	Fedora Local Security Checks	medium
47238	Fedora 11 : automake15-1.5-29.fc11.1 (2010-1174)	Nessus	Fedora Local Security Checks	medium
47235	Fedora 11 : automake16-1.6.3-18.fc11.1 (2010-1148)	Nessus	Fedora Local Security Checks	medium
46289	RHEL 5 : automake (RHSA-2010:0321)	Nessus	Red Hat Local Security Checks	medium
44879	Fedora 12 : automake-1.11.1-1.fc12 (2009-13157)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2009-4029

high

Tenable Plugins

high

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium