The "distcheck" Makefile rule in coreutils 5.2.1 through to 8.1 did use unsafe (predictable) temporary directory location for performing own tasks. This might allow local attacker to conduct symlink attacks under certain circumstances. Upstream patch: --------------- http://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=ae034822c535fa5 Credit: ------- Jim Meyering CVE Request: ------------ http://www.openwall.com/lists/oss-security/2009/12/08/4
Note that the offending rule is run as part of "make distcheck".
Thanks for the catch Jim, substituted "my-distcheck" for "distcheck".
This is CVE-2009-4135.
coreutils-7.6-8.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/coreutils-7.6-8.fc12
coreutils-7.2-5.fc11 has been submitted as an update for Fedora 11. http://admin.fedoraproject.org/updates/coreutils-7.2-5.fc11
The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here: http://www.redhat.com/security/updates/classification/
coreutils-7.2-5.fc11 has been pushed to the Fedora 11 stable repository. If problems still persist, please make note of it in this bug report.
coreutils-7.6-8.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.
Closing this nextrelease as it was addressed in Fedora coreutils makefiles and will be fixed in Red Hat Enterprise Linux 6 too. This flaw is in the distcheck rule, used by coreutils upstream developers to prepare and check distribution source tarballs. It does not affect users using binary RPMs or rebuilding source RPMs (distcheck target is not used during the SRPM build).