Mercurial Mercurial > upstream > oracle > userland-gate / annotate
summary | shortlog | changelog | graph | tags | bookmarks | branches | files | changeset | file | latest | revisions | annotate | diff | comparison | raw | help
Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
components/automake/automake-1.11.2/patches/CVE-2012-3386.patch
author Tomas Kuthan <tomas.kuthan@oracle.com>
Fri, 21 Mar 2014 09:36:50 -0700
changeset 1783 d716b9b5961b
parent 911 eec41ee6c6ad
permissions -rw-r--r--
18267729 Delegating credentials in OpenSSH
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
911
eec41ee6c6ad 7182673 Problem with utility/automake
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset 
     1
 
--- automake-1.11.2/NEWS.orig	2012-07-10 05:55:08.774803866 -0700
eec41ee6c6ad 7182673 Problem with utility/automake
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset 
     2
 
+++ automake-1.11.2/NEWS	2012-07-10 05:55:40.618794747 -0700
eec41ee6c6ad 7182673 Problem with utility/automake
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset 
     3
 
@@ -90,6 +90,15 @@
eec41ee6c6ad 7182673 Problem with utility/automake
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset 
     4
 
   - The AM_COND_IF macro also works if the shell expression for the
eec41ee6c6ad 7182673 Problem with utility/automake
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset 
     5
 
     conditional is no longer valid for the condition.
eec41ee6c6ad 7182673 Problem with utility/automake
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset 
     6
eec41ee6c6ad 7182673 Problem with utility/automake
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset 
     7
 
+* SECURITY VULNERABILITIES!
eec41ee6c6ad 7182673 Problem with utility/automake
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset 
     8
 
+
eec41ee6c6ad 7182673 Problem with utility/automake
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset 
     9
 
+  - The recipe of the 'distcheck' no longer grants anymore temporary
eec41ee6c6ad 7182673 Problem with utility/automake
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset 
    10
 
+    world-wide write permissions on the extracted distdir.  Even if such
eec41ee6c6ad 7182673 Problem with utility/automake
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset 
    11
 
+    rights were only granted for a vanishingly small time window, the
eec41ee6c6ad 7182673 Problem with utility/automake
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset 
    12
 
+    implied race condition proved to be enough to allow a local attacker
eec41ee6c6ad 7182673 Problem with utility/automake
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset 
    13
 
+    to run arbitrary code with the privileges of the user running "make
eec41ee6c6ad 7182673 Problem with utility/automake
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset 
    14
 
+    distcheck".  This is CVE-2012-3386.
eec41ee6c6ad 7182673 Problem with utility/automake
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset 
    15
 
+
eec41ee6c6ad 7182673 Problem with utility/automake
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset 
    16
 
 * Long-standing bugs:
eec41ee6c6ad 7182673 Problem with utility/automake
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset 
    17
eec41ee6c6ad 7182673 Problem with utility/automake
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset 
    18
 
   - The order of Yacc and Lex flags is fixed to be consistent with other
eec41ee6c6ad 7182673 Problem with utility/automake
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset 
    19
 
--- automake-1.11.2/lib/am/distdir.am.orig	2012-07-10 05:57:02.481964158 -0700
eec41ee6c6ad 7182673 Problem with utility/automake
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset 
    20
 
+++ automake-1.11.2/lib/am/distdir.am	2012-07-10 05:57:54.509361759 -0700
eec41ee6c6ad 7182673 Problem with utility/automake
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset 
    21
 
@@ -441,7 +441,7 @@
eec41ee6c6ad 7182673 Problem with utility/automake
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset 
    22
 
 ## Make the new source tree read-only.  Distributions ought to work in
eec41ee6c6ad 7182673 Problem with utility/automake
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset 
    23
 
 ## this case.  However, make the top-level directory writable so we
eec41ee6c6ad 7182673 Problem with utility/automake
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset 
    24
 
 ## can make our new subdirs.
eec41ee6c6ad 7182673 Problem with utility/automake
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset 
    25
 
-	chmod -R a-w $(distdir); chmod a+w $(distdir)
eec41ee6c6ad 7182673 Problem with utility/automake
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset 
    26
 
+	chmod -R a-w $(distdir); chmod u+w $(distdir)
eec41ee6c6ad 7182673 Problem with utility/automake
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset 
    27
 
 	mkdir $(distdir)/_build
eec41ee6c6ad 7182673 Problem with utility/automake
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset 
    28
 
 	mkdir $(distdir)/_inst
eec41ee6c6ad 7182673 Problem with utility/automake
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset 
    29
 
 ## Undo the write access.
upstream/oracle/userland-gate