Automake - Red Hat ENTERPRISE LINUX 5.5 - TECHNICAL NOTES Manual

Chapter 1. Package Updates
• autofs failed to load its maps if all LDAP servers were down, or unreachable, when the daemon
started. The dependency on an LDAP server being available at startup has been removed. This
change resolved the issue of the map server being unreachable for some common usage cases.
72
(BZ#543554 )
• The random selection option used with mount locations that have multiple servers was not being
set correctly during the paring of master map entries. If specified as a mount option in master map
entries the option is now used as has been requested.
• Setting the expire timeout to 0 was causing autofs to constantly schedule expire runs leading to
excessive resource usage and preature umounting of mounts. Setting the timeout to 0 should in fact
disable expiry of mounts and this update fixes this incorrect behavior.
• autofs would abort when using DIGEST-MD5 authentication under heavy concurrent access.
This was caused by autofs not providing the locking functions required by the cyrus-sasl library.
In addition the cyrus-sasl library locking functions contained a race which sometimes lead to a
deadlock. This update adds the needed locking functions to autofs and passes them to cyrus-sasl at
initialization. The bug in the cyrus-sasl library is fixed in cyrus-sasl-lib 2.1.22-5.el5.el5_4.3 and later
which is required for the update to install if cyrus-sasl is also installed.
All autofs users should upgrade to this updated package, which resolves these issues.

1.9. automake

1.9.1. RHSA-2010:0321: Low security update
Updated automake, automake14, automake15, automake16, and automake17 packages that fix one
security issue are now available for Red Hat Enterprise Linux 5.
The Red Hat Security Response Team has rated this update as having low security impact. A
Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is
available from the CVE link in the References section.
Automake is a tool for automatically generating Makefile.in files compliant with the GNU Coding
Standards.
Automake-generated Makefiles made certain directories world-writable when preparing source
archives, as was recommended by the GNU Coding Standards. If a malicious, local user could access
the directory where a victim was creating distribution archives, they could use this flaw to modify the
files being added to those archives. Makefiles generated by these updated automake packages no
longer make distribution directories world-writable, as recommended by the updated GNU Coding
Standards. (CVE-2009-4029
Note: This issue affected Makefile targets used by developers to prepare distribution source archives.
Those targets are not used when compiling programs from the source code.
All users of automake, automake14, automake15, automake16, and automake17 should upgrade to
these updated packages, which resolve this issue.
76
https://www.redhat.com/security/data/cve/CVE-2009-4029.html
12
76
)
73
(BZ#548476 )
(BZ#548277
(BZ#559430
74
)
75
)