The "make distcheck" rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world-writable permissions to the extraction directory, which introduces a race condition that allows local users to execute arbitrary code via unspecified vectors.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - automake: locally exploitable make distcheck bug (CVE-2012-3386)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - automake: locally exploitable make distcheck bug (CVE-2012-3386)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2022:10031-1 advisory.

  - The make distcheck rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world-writable     permissions to the extraction directory, which introduces a race condition that allows local users to     execute arbitrary code via unspecified vectors. (CVE-2012-3386)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was found that the distcheck rule in Automake-generated Makefiles made a directory world-writable when preparing source archives. If a malicious, local user could access this directory, they could execute arbitrary code with the privileges of the user running 'make distcheck'.

An updated automake package that fixes one security issue is now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Automake is a tool for automatically generating Makefile.in files compliant with the GNU Coding Standards.

It was found that the distcheck rule in Automake-generated Makefiles made a directory world-writable when preparing source archives. If a malicious, local user could access this directory, they could execute arbitrary code with the privileges of the user running 'make distcheck'. (CVE-2012-3386)

Red Hat would like to thank Jim Meyering for reporting this issue.
Upstream acknowledges Stefano Lattarini as the original reporter.

All automake users are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

It was found that the distcheck rule in Automake-generated Makefiles made a directory world-writable when preparing source archives. If a malicious, local user could access this directory, they could execute arbitrary code with the privileges of the user running 'make distcheck'. (CVE-2012-3386)

From Red Hat Security Advisory 2014:1243 :

An updated automake package that fixes one security issue is now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Automake is a tool for automatically generating Makefile.in files compliant with the GNU Coding Standards.

It was found that the distcheck rule in Automake-generated Makefiles made a directory world-writable when preparing source archives. If a malicious, local user could access this directory, they could execute arbitrary code with the privileges of the user running 'make distcheck'. (CVE-2012-3386)

Red Hat would like to thank Jim Meyering for reporting this issue.
Upstream acknowledges Stefano Lattarini as the original reporter.

All automake users are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

The remote Redhat Enterprise Linux 5 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2014:1243 advisory.

    Automake is a tool for automatically generating Makefile.in files compliant     with the GNU Coding Standards.

    It was found that the distcheck rule in Automake-generated Makefiles made a     directory world-writable when preparing source archives. If a malicious,     local user could access this directory, they could execute arbitrary code     with the privileges of the user running make distcheck. (CVE-2012-3386)

    Red Hat would like to thank Jim Meyering for reporting this issue. Upstream     acknowledges Stefano Lattarini as the original reporter.

    All automake users are advised to upgrade to this updated package, which     contains a backported patch to correct this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Automake received fixes for race conditions in 'make distcheck', where tarballs were created world-writeable.

The remote host is affected by the vulnerability described in GLSA-201310-15 (GNU Automake: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in GNU Automake. Please       review the CVE identifiers referenced below for details.
  Impact :

    A local attacker could execute arbitrary commands with the privileges of       the user running an Automake-based build.
  Workaround :

    There is no known workaround at this time.

This update of automake fixes a race condition in 'distcheck'.
(CVE-2012-3386)

Also a bug where world writeable tarballs were generated during 'make dist' has been fixed. (CVE-2009-4029)

From Red Hat Security Advisory 2013:0526 :

An updated automake package that fixes one security issue is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Automake is a tool for automatically generating Makefile.in files compliant with the GNU Coding Standards.

It was found that the distcheck rule in Automake-generated Makefiles made a directory world-writable when preparing source archives. If a malicious, local user could access this directory, they could execute arbitrary code with the privileges of the user running 'make distcheck'. (CVE-2012-3386)

Red Hat would like to thank Jim Meyering for reporting this issue.
Upstream acknowledges Stefano Lattarini as the original reporter.

Users of automake are advised to upgrade to this updated package, which corrects this issue.

A vulnerability has been discovered and corrected in automake :

A race condition in automake (lib/am/distdir.am) could allow a local attacker to run arbitrary code with the privileges of the user running make distcheck (CVE-2012-3386).

The updated packages have been patched to correct this issue.

NOTE: This advisory was previousely given the MDVSA-2013:018 identifier by mistake.

An updated automake package that fixes one security issue is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Automake is a tool for automatically generating Makefile.in files compliant with the GNU Coding Standards.

It was found that the distcheck rule in Automake-generated Makefiles made a directory world-writable when preparing source archives. If a malicious, local user could access this directory, they could execute arbitrary code with the privileges of the user running 'make distcheck'. (CVE-2012-3386)

Red Hat would like to thank Jim Meyering for reporting this issue.
Upstream acknowledges Stefano Lattarini as the original reporter.

Users of automake are advised to upgrade to this updated package, which corrects this issue.

Fixed security problem CVE-2012-3386.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2012-3386 fix

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- automake-1.11.6, fixes CVE-2012-3386

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been discovered and corrected in automake :

A race condition in automake (lib/am/distdir.am) could allow a local attacker to run arbitrary code with the privileges of the user running make distcheck (CVE-2012-3386).

The updated packages have been patched to correct this issue.

GNU reports :

The recipe of the 'distcheck' target granted temporary world-write permissions on the extracted distdir. This introduced a locally exploitable race condition for those who run 'make distcheck' with a non-restrictive umask (e.g., 022) in a directory that was accessible by others. A successful exploit would result in arbitrary code execution with the privileges of the user running 'make distcheck'.

It is important to stress that this vulnerability impacts not only the Automake package itself, but all packages with Automake-generated makefiles. For an effective fix it is necessary to regenerate the Makefile.in files with a fixed Automake version.

New libpng packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, 13.0, 13.1, 13.37, and -current to fix security issues.

ID	Name	Product	Family	Severity
198519	RHEL 5 : automake17 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198487	RHEL 6 : automake17 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
162617	openSUSE 15 Security Update : wdiff (openSUSE-SU-2022:10031-1)	Nessus	SuSE Local Security Checks	high
78344	Amazon Linux AMI : automake19 (ALAS-2014-401)	Nessus	Amazon Linux Local Security Checks	medium
77990	CentOS 5 : automake (CESA-2014:1243)	Nessus	CentOS Local Security Checks	medium
77954	Scientific Linux Security Update : automake on SL5.x (noarch) (20140916)	Nessus	Scientific Linux Local Security Checks	medium
77736	Oracle Linux 5 : automake (ELSA-2014-1243)	Nessus	Oracle Linux Local Security Checks	medium
77696	RHEL 5 : automake (RHSA-2014:1243)	Nessus	Red Hat Local Security Checks	high
74814	openSUSE Security Update : automake (openSUSE-SU-2012:1519-1)	Nessus	SuSE Local Security Checks	medium
70650	GLSA-201310-15 : GNU Automake: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
69345	SuSE 11.2 / 11.3 Security Update : automake (SAT Patch Numbers 8196 / 8197)	Nessus	SuSE Local Security Checks	medium
68761	Oracle Linux 6 : automake (ELSA-2013-0526)	Nessus	Oracle Linux Local Security Checks	medium
66045	Mandriva Linux Security Advisory : automake (MDVSA-2013:031)	Nessus	Mandriva Local Security Checks	medium
65156	CentOS 6 : automake (CESA-2013:0526)	Nessus	CentOS Local Security Checks	medium
64947	Scientific Linux Security Update : automake on SL6.x (noarch) (20130221)	Nessus	Scientific Linux Local Security Checks	medium
64772	RHEL 6 : automake (RHSA-2013:0526)	Nessus	Red Hat Local Security Checks	medium
62421	Fedora 16 : automake17-1.7.9-15.fc16 (2012-14779)	Nessus	Fedora Local Security Checks	medium
62420	Fedora 17 : automake17-1.7.9-16.fc17 (2012-14770)	Nessus	Fedora Local Security Checks	medium
62419	Fedora 18 : automake17-1.7.9-17.fc18 (2012-14762)	Nessus	Fedora Local Security Checks	medium
62231	Fedora 16 : automake-1.11.6-1.fc16 (2012-14297)	Nessus	Fedora Local Security Checks	medium
62193	Fedora 17 : automake-1.11.6-1.fc17 (2012-14349)	Nessus	Fedora Local Security Checks	medium
61957	Mandriva Linux Security Advisory : automake (MDVSA-2012:103)	Nessus	Mandriva Local Security Checks	medium
61451	FreeBSD : automake -- Insecure 'distcheck' recipe granted world-writable distdir (36235c38-e0a8-11e1-9f4d-002354ed89bc)	Nessus	FreeBSD Local Security Checks	medium
60112	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / 8.1 / 9.0 / 9.1 / current : libpng (SSA:2012-206-01)	Nessus	Slackware Local Security Checks	medium

Detections

Analytics

CVE-2012-3386

high

Tenable Plugins

high

high

high

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium