1 files changed, 65 insertions, 0 deletions
diff --git a/metadata/glsa/glsa-200404-08.xml b/metadata/glsa/glsa-200404-08.xml
new file mode 100644
index 000000000000..6055ca1e37dc
--- /dev/null
+++ b/metadata/glsa/glsa-200404-08.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="200404-08">
+  <title>GNU Automake symbolic link vulnerability</title>
+  <synopsis>
+    Automake may be vulnerable to a symbolic link attack which may allow an
+    attacker to modify data or elevate their privileges.
+  </synopsis>
+  <product type="ebuild">automake</product>
+  <announced>2004-04-08</announced>
+  <revised count="05">2005-01-31</revised>
+  <bug>45646</bug>
+  <access>local</access>
+  <affected>
+    <package name="sys-devel/automake" auto="yes" arch="*">
+      <unaffected range="ge">1.8.5-r3</unaffected>
+      <unaffected range="rge">1.7.9-r1</unaffected>
+      <unaffected range="lt">1.7</unaffected>
+      <vulnerable range="le">1.8.5-r2</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    Automake is a tool for automatically generating `Makefile.in' files
+    which is often used in conjuction with Autoconf and other GNU Autotools
+    to ease portability among applications. It also provides a standardized
+    and light way of writing complex Makefiles through the use of many
+    built-in macros.
+    </p>
+  </background>
+  <description>
+    <p>
+    Automake may be vulnerable to a symbolic link attack which may allow an
+    attacker to modify data or escalate their privileges. This is due to
+    the insecure way Automake creates directories during compilation. An
+    attacker may be able to create symbolic links in the place of files
+    contained in the affected directories, which may potentially lead to
+    elevated privileges due to modification of data.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>
+    An attacker may be able to use this vulnerability to modify data in an
+    unauthorized fashion or elevate their privileges.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    A workaround is not currently known for this issue. All users are
+    advised to upgrade to the latest version of the affected package.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    Automake users should upgrade to the latest versions:
+    </p>
+    <code>
+    # emerge --sync
+    # emerge --ask --oneshot --verbose sys-devel/automake</code>
+  </resolution>
+  <references/>
+  <metadata tag="submitter">
+    klieber
+  </metadata>
+</glsa>