Skip to navigation

Security Advisory Low: automake security update

Advisory: RHSA-2010:0321-4
Type: Security Advisory
Severity: Low
Issued on: 2010-03-30
Last updated on: 2010-03-30
Affected Products: RHEL Desktop Workstation (v. 5 client)
Red Hat Enterprise Linux (v. 5 server)
CVEs (cve.mitre.org): CVE-2009-4029

Details

Updated automake, automake14, automake15, automake16, and automake17
packages that fix one security issue are now available for Red Hat
Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Automake is a tool for automatically generating Makefile.in files compliant
with the GNU Coding Standards.

Automake-generated Makefiles made certain directories world-writable when
preparing source archives, as was recommended by the GNU Coding Standards.
If a malicious, local user could access the directory where a victim was
creating distribution archives, they could use this flaw to modify the
files being added to those archives. Makefiles generated by these updated
automake packages no longer make distribution directories world-writable,
as recommended by the updated GNU Coding Standards. (CVE-2009-4029)

Note: This issue affected Makefile targets used by developers to prepare
distribution source archives. Those targets are not used when compiling
programs from the source code.

All users of automake, automake14, automake15, automake16, and automake17
should upgrade to these updated packages, which resolve this issue.


Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Updated packages

RHEL Desktop Workstation (v. 5 client)

SRPMS:
automake-1.9.6-2.3.el5.src.rpm     MD5: 0720026daa7ccb3ebb6d537aefb10e94
SHA-256: 33a35c1d249cf24b69c489f1456cf0091134966bafd60b95ca7b3ec7801d7cab
automake14-1.4p6-13.el5.1.src.rpm     MD5: 5c2e39b32a9e3d8dcc6d7ac115474ea6
SHA-256: 016e7f8f85de7cf5b8a9f4c79453dbb13685afde5dc1e8df5b3f035152a5ae9b
automake15-1.5-16.el5.2.src.rpm     MD5: 4cee6b1173a57420ce34b8c65cf2d55d
SHA-256: fdcb45a9efdec023c41449e75e5b1f6273f8d0cbdce38d777fa6855b183285b9
automake16-1.6.3-8.el5.1.src.rpm     MD5: 37d408df994fffb953daa5f9a47a5b7e
SHA-256: 34baf6d28b03a3dbb0ac20850a1c7b5520303d9dfd6c41763d0b1947bbbe5a81
automake17-1.7.9-7.el5.2.src.rpm     MD5: d62e74e0f4cedcef74ef1728309f3c7c
SHA-256: 8c7e75f2a52e633709c06de2d9503167de7273ee90db16c65fd3e75199ff299d
 
IA-32:
automake-1.9.6-2.3.el5.noarch.rpm     MD5: c97b6f60d8f1e8902146a3bec9a1ac5b
SHA-256: 383ae703604784d8a22353c63f1ef9e0802f2f782613ccdc0c0b603b7b304e56
automake14-1.4p6-13.el5.1.noarch.rpm     MD5: feaf9896f13e5af856c568f9f14382fb
SHA-256: 144213cd30a5d86db30739d4a110a9e356cc67f3ad10a2ca8350dca139c869b0
automake15-1.5-16.el5.2.noarch.rpm     MD5: 8f0d4a080d326ad92d6d28dc5121304f
SHA-256: fbd6a4c8ef56a66b1c68abc40326857cbf1973751af66437419ca24efa7d611b
automake16-1.6.3-8.el5.1.noarch.rpm     MD5: eb8f8f45e1454139957bccd3d8517f51
SHA-256: c783a8230883aee1ae81b76983093030de4a1b5975ebf6745aae95c00d71195e
automake17-1.7.9-7.el5.2.noarch.rpm     MD5: f230f79038c963dccc40ebeab7def17f
SHA-256: 95c445531f44176599191562d6167c9987f8ef9779e88b0ca904e08eb0def2ec
 
x86_64:
automake-1.9.6-2.3.el5.noarch.rpm     MD5: c97b6f60d8f1e8902146a3bec9a1ac5b
SHA-256: 383ae703604784d8a22353c63f1ef9e0802f2f782613ccdc0c0b603b7b304e56
automake14-1.4p6-13.el5.1.noarch.rpm     MD5: feaf9896f13e5af856c568f9f14382fb
SHA-256: 144213cd30a5d86db30739d4a110a9e356cc67f3ad10a2ca8350dca139c869b0
automake15-1.5-16.el5.2.noarch.rpm     MD5: 8f0d4a080d326ad92d6d28dc5121304f
SHA-256: fbd6a4c8ef56a66b1c68abc40326857cbf1973751af66437419ca24efa7d611b
automake16-1.6.3-8.el5.1.noarch.rpm     MD5: eb8f8f45e1454139957bccd3d8517f51
SHA-256: c783a8230883aee1ae81b76983093030de4a1b5975ebf6745aae95c00d71195e
automake17-1.7.9-7.el5.2.noarch.rpm     MD5: f230f79038c963dccc40ebeab7def17f
SHA-256: 95c445531f44176599191562d6167c9987f8ef9779e88b0ca904e08eb0def2ec
 
Red Hat Enterprise Linux (v. 5 server)

SRPMS:
automake-1.9.6-2.3.el5.src.rpm     MD5: 0720026daa7ccb3ebb6d537aefb10e94
SHA-256: 33a35c1d249cf24b69c489f1456cf0091134966bafd60b95ca7b3ec7801d7cab
automake14-1.4p6-13.el5.1.src.rpm     MD5: 5c2e39b32a9e3d8dcc6d7ac115474ea6
SHA-256: 016e7f8f85de7cf5b8a9f4c79453dbb13685afde5dc1e8df5b3f035152a5ae9b
automake15-1.5-16.el5.2.src.rpm     MD5: 4cee6b1173a57420ce34b8c65cf2d55d
SHA-256: fdcb45a9efdec023c41449e75e5b1f6273f8d0cbdce38d777fa6855b183285b9
automake16-1.6.3-8.el5.1.src.rpm     MD5: 37d408df994fffb953daa5f9a47a5b7e
SHA-256: 34baf6d28b03a3dbb0ac20850a1c7b5520303d9dfd6c41763d0b1947bbbe5a81
automake17-1.7.9-7.el5.2.src.rpm     MD5: d62e74e0f4cedcef74ef1728309f3c7c
SHA-256: 8c7e75f2a52e633709c06de2d9503167de7273ee90db16c65fd3e75199ff299d
 
IA-32:
automake-1.9.6-2.3.el5.noarch.rpm     MD5: c97b6f60d8f1e8902146a3bec9a1ac5b
SHA-256: 383ae703604784d8a22353c63f1ef9e0802f2f782613ccdc0c0b603b7b304e56
automake14-1.4p6-13.el5.1.noarch.rpm     MD5: feaf9896f13e5af856c568f9f14382fb
SHA-256: 144213cd30a5d86db30739d4a110a9e356cc67f3ad10a2ca8350dca139c869b0
automake15-1.5-16.el5.2.noarch.rpm     MD5: 8f0d4a080d326ad92d6d28dc5121304f
SHA-256: fbd6a4c8ef56a66b1c68abc40326857cbf1973751af66437419ca24efa7d611b
automake16-1.6.3-8.el5.1.noarch.rpm     MD5: eb8f8f45e1454139957bccd3d8517f51
SHA-256: c783a8230883aee1ae81b76983093030de4a1b5975ebf6745aae95c00d71195e
automake17-1.7.9-7.el5.2.noarch.rpm     MD5: f230f79038c963dccc40ebeab7def17f
SHA-256: 95c445531f44176599191562d6167c9987f8ef9779e88b0ca904e08eb0def2ec
 
IA-64:
automake-1.9.6-2.3.el5.noarch.rpm     MD5: c97b6f60d8f1e8902146a3bec9a1ac5b
SHA-256: 383ae703604784d8a22353c63f1ef9e0802f2f782613ccdc0c0b603b7b304e56
automake14-1.4p6-13.el5.1.noarch.rpm     MD5: feaf9896f13e5af856c568f9f14382fb
SHA-256: 144213cd30a5d86db30739d4a110a9e356cc67f3ad10a2ca8350dca139c869b0
automake15-1.5-16.el5.2.noarch.rpm     MD5: 8f0d4a080d326ad92d6d28dc5121304f
SHA-256: fbd6a4c8ef56a66b1c68abc40326857cbf1973751af66437419ca24efa7d611b
automake16-1.6.3-8.el5.1.noarch.rpm     MD5: eb8f8f45e1454139957bccd3d8517f51
SHA-256: c783a8230883aee1ae81b76983093030de4a1b5975ebf6745aae95c00d71195e
automake17-1.7.9-7.el5.2.noarch.rpm     MD5: f230f79038c963dccc40ebeab7def17f
SHA-256: 95c445531f44176599191562d6167c9987f8ef9779e88b0ca904e08eb0def2ec
 
PPC:
automake-1.9.6-2.3.el5.noarch.rpm     MD5: c97b6f60d8f1e8902146a3bec9a1ac5b
SHA-256: 383ae703604784d8a22353c63f1ef9e0802f2f782613ccdc0c0b603b7b304e56
automake14-1.4p6-13.el5.1.noarch.rpm     MD5: feaf9896f13e5af856c568f9f14382fb
SHA-256: 144213cd30a5d86db30739d4a110a9e356cc67f3ad10a2ca8350dca139c869b0
automake15-1.5-16.el5.2.noarch.rpm     MD5: 8f0d4a080d326ad92d6d28dc5121304f
SHA-256: fbd6a4c8ef56a66b1c68abc40326857cbf1973751af66437419ca24efa7d611b
automake16-1.6.3-8.el5.1.noarch.rpm     MD5: eb8f8f45e1454139957bccd3d8517f51
SHA-256: c783a8230883aee1ae81b76983093030de4a1b5975ebf6745aae95c00d71195e
automake17-1.7.9-7.el5.2.noarch.rpm     MD5: f230f79038c963dccc40ebeab7def17f
SHA-256: 95c445531f44176599191562d6167c9987f8ef9779e88b0ca904e08eb0def2ec
 
s390x:
automake-1.9.6-2.3.el5.noarch.rpm     MD5: c97b6f60d8f1e8902146a3bec9a1ac5b
SHA-256: 383ae703604784d8a22353c63f1ef9e0802f2f782613ccdc0c0b603b7b304e56
automake14-1.4p6-13.el5.1.noarch.rpm     MD5: feaf9896f13e5af856c568f9f14382fb
SHA-256: 144213cd30a5d86db30739d4a110a9e356cc67f3ad10a2ca8350dca139c869b0
automake15-1.5-16.el5.2.noarch.rpm     MD5: 8f0d4a080d326ad92d6d28dc5121304f
SHA-256: fbd6a4c8ef56a66b1c68abc40326857cbf1973751af66437419ca24efa7d611b
automake16-1.6.3-8.el5.1.noarch.rpm     MD5: eb8f8f45e1454139957bccd3d8517f51
SHA-256: c783a8230883aee1ae81b76983093030de4a1b5975ebf6745aae95c00d71195e
automake17-1.7.9-7.el5.2.noarch.rpm     MD5: f230f79038c963dccc40ebeab7def17f
SHA-256: 95c445531f44176599191562d6167c9987f8ef9779e88b0ca904e08eb0def2ec
 
x86_64:
automake-1.9.6-2.3.el5.noarch.rpm     MD5: c97b6f60d8f1e8902146a3bec9a1ac5b
SHA-256: 383ae703604784d8a22353c63f1ef9e0802f2f782613ccdc0c0b603b7b304e56
automake14-1.4p6-13.el5.1.noarch.rpm     MD5: feaf9896f13e5af856c568f9f14382fb
SHA-256: 144213cd30a5d86db30739d4a110a9e356cc67f3ad10a2ca8350dca139c869b0
automake15-1.5-16.el5.2.noarch.rpm     MD5: 8f0d4a080d326ad92d6d28dc5121304f
SHA-256: fbd6a4c8ef56a66b1c68abc40326857cbf1973751af66437419ca24efa7d611b
automake16-1.6.3-8.el5.1.noarch.rpm     MD5: eb8f8f45e1454139957bccd3d8517f51
SHA-256: c783a8230883aee1ae81b76983093030de4a1b5975ebf6745aae95c00d71195e
automake17-1.7.9-7.el5.2.noarch.rpm     MD5: f230f79038c963dccc40ebeab7def17f
SHA-256: 95c445531f44176599191562d6167c9987f8ef9779e88b0ca904e08eb0def2ec
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

542609 - CVE-2009-4029 Automake: Race condition by creation of "distdir" based directory hierarchy


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/