4.4

CVE-2009-4029

Exploit
The (1) dist or (2) distcheck rules in GNU Automake 1.11.1, 1.10.3, and release branches branch-1-4 through branch-1-9, when producing a distribution tarball for a package that uses Automake, assign insecure permissions (777) to directories in the build tree, which introduces a race condition that allows local users to modify the contents of package files, introduce Trojan horse programs, or conduct other attacks before the build is complete.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gnu ≫ Automake Version1.10.3
Gnu ≫ Automake Version1.11.1
Gnu ≫ Automake Versionbranch Update1-9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.48% 0.374
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.4 3.4 6.4
AV:L/AC:M/Au:N/C:P/I:P/A:P
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

http://lists.gnu.org/archive/html/automake-patches/2009-11/msg00017.html
Exploit
http://lists.gnu.org/archive/html/automake/2009-12/msg00010.html
http://lists.gnu.org/archive/html/automake/2009-12/msg00011.html
http://lists.gnu.org/archive/html/automake/2009-12/msg00012.html
Patch
http://lists.gnu.org/archive/html/automake/2009-12/msg00013.html
http://savannah.gnu.org/forum/forum.php?forum_id=6077
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021784.1-1
http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0071
http://www.mandriva.com/security/advisories?name=MDVSA-2010:203
http://www.securityfocus.com/archive/1/514526/100/0/threaded
http://www.vupen.com/english/advisories/2009/3579
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11717