Sylvain Beucler
2010-Feb-21 21:03 UTC
[Secure-testing-team] Bug#570850: automake: Fix CVE-2009-4029 in Lenny/stable
Package: automake
Version: 1:1.10.1-3
Severity: grave
Tags: security patch
Justification: user security hole
Hi,
Please fix CVE-2009-4029 in automake 1.10.
I create my upstream releases from a Debian stable box, and I was
surprised to see that the generated Makefile.in''s still have
instructions for 777 directories.
Attached is a patch :)
Cheers!
-- System Information:
Debian Release: 5.0.4
APT prefers stable
APT policy: (500, ''stable'')
Architecture: i386 (i686)
Kernel: Linux 2.6.26-2-686 (SMP w/1 CPU core)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Versions of packages automake depends on:
ii autoconf 2.61-8 automatic configure script builder
ii autotools-dev 20080123.1 Update infrastructure for config.{
automake recommends no packages.
automake suggests no packages.
-- no debconf information
-------------- next part --------------
--- automake1.10-1.10.1/debian/changelog
+++ automake1.10-1.10.1/debian/changelog
@@ -1,3 +1,11 @@
+automake1.10 (1:1.10.1-4) stable-security; urgency=high
+
+ [ Sylvain Beucler ]
+ * Fix CVE-2009-4029, which created world-writable directories in
+ distribution tarballs.
+
+ -- Eric Dorland <eric at debian.org> Sun, 21 Feb 2010 21:45:48 +0100
+
automake1.10 (1:1.10.1-3) unstable; urgency=low
* debian/automake.postinst: Bump up the priority to 28 so that it wins
--- automake1.10-1.10.1.orig/lib/am/distdir.am
+++ automake1.10-1.10.1/lib/am/distdir.am
@@ -196,11 +196,7 @@
endif %?DIST-TARGETS%
##
## This complex find command will try to avoid changing the modes of
-## links into the source tree, in case they''re hard-linked. It will
-## also make directories writable by everybody, because some
-## brain-dead tar implementations change ownership and permissions of
-## a directory before extracting the files, thus becoming unable to
-## extract them.
+## links into the source tree, in case they''re hard-linked.
##
## Ignore return result from chmod, because it might give an error
## if we chmod a symlink.
@@ -213,7 +209,8 @@
## the file in place in the source tree.
##
if %?TOPDIR_P%
- -find $(distdir) -type d ! -perm -777 -exec chmod a+rwx {} \; -o \
+ -find $(distdir) -type d ! -perm -755 \
+ -exec chmod u+rwx,go+rx {} \; -o \
! -type d ! -perm -444 -links 1 -exec chmod a+r {} \; -o \
! -type d ! -perm -400 -exec chmod a+r {} \; -o \
! -type d ! -perm -444 -exec $(install_sh) -c -m a+r {} {} \; \