Risk | Low |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2009-4029 |
CWE-ID | CWE-362 |
Exploitation vector | Local |
Public exploit | N/A |
Vulnerable software Subscribe |
automake (Alpine package) Operating systems & Components / Operating system package or component |
Vendor | Alpine Linux Development Team |
Security Bulletin
This security bulletin contains one low risk vulnerability.
EUVDB-ID: #VU32694
Risk: Low
CVSSv3.1: 5.2 [CVSS:3.1/CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2009-4029
Exploit availability: No
DescriptionThe vulnerability allows a local non-authenticated attacker to read and manipulate data.
The (1) dist or (2) distcheck rules in GNU Automake 1.11.1, 1.10.3, and release branches branch-1-4 through branch-1-9, when producing a distribution tarball for a package that uses Automake, assign insecure permissions (777) to directories in the build tree, which introduces a race condition that allows local users to modify the contents of package files, introduce Trojan horse programs, or conduct other attacks before the build is complete.
MitigationInstall update from vendor's website.
Vulnerable software versionsautomake (Alpine package): 1.11.1-r0
CPE2.3 External linkshttp://git.alpinelinux.org/aports/commit/?id=b2343efd22068339ff40fa6f2843c0dc091b1a99
http://git.alpinelinux.org/aports/commit/?id=34b273c51b4fce732e99c67ea3f9100ae6fbddbe
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.