Amanda Backup System - Privilege Escalation and Information Leak
Summary
DLA-3681-1: amanda - security update. Affects amanda versions < 1:3.5.1-2+deb10u2. Fixed in 1:3.5.1-2+deb10u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Amanda is a backup system designed to archive multiple computers on a network to a single tape drive. It provides a centralized solution for data backup and recovery. However, certain vulnerabilities have been discovered in Amanda that could potentially lead to privilege escalation and information leakage.
Vulnerability Detail
The first vulnerability, identified as CVE-2022-37703, involves an information leak in the calcsize SUID binary. Attackers can exploit this vulnerability to determine the existence of directories in the filesystem. The binary does not properly validate the path provided by the attacker, allowing them to specify an arbitrary path and execute opendir() as root.
The second vulnerability, CVE-2022-37705, is a privilege escalation flaw in the runtar SUID program. This program acts as a wrapper for the tar binary and allows the backup user to run tar with specific arguments. However, the program mishandles the arguments passed to the tar binary, enabling the attacker to acquire root privileges.
The third vulnerability, CVE-2023-30577, affects the runtar SUID binary as well. It can accept potentially malicious GNU tar options if fed with a non-argument option starting with "--exclude". This flaw could lead to the execution of scripts or binaries with root permissions.
How To Fix
Minimum fixed version
1:3.5.1-2+deb10u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade amandaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Amanda backup system is susceptible to privilege escalation and information leakage vulnerabilities. To mitigate these risks, it is crucial to update the amanda packages to version 1:3.5.1-2+deb10u2 or later. For further assistance or support in addressing these vulnerabilities, please contact DevNack.com.
See every vulnerability recorded for amanda →
FAQ
CVE-2022-37703 allows an attacker to determine the existence of directories in the filesystem. This information leakage can potentially aid in further attacks or reconnaissance.
CVE-2022-37705 enables the backup user to escalate their privileges to root. By manipulating the arguments passed to the runtar SUID program, an attacker can execute arbitrary commands with elevated permissions.
CVE-2023-30577 poses a risk of executing scripts or binaries with root permissions. If an attacker can provide a non-argument option starting with "--exclude" to the runtar SUID binary, they can pass malicious options to the underlying tar binary.
To check the version of amanda installed on your system, you can use the following command:
$ amcheck -V
No specific workarounds have been mentioned for these vulnerabilities. It is recommended to apply the provided fix by upgrading to the latest version of the amanda packages.
Related vulnerabilities
Recent vulnerabilities recorded for amanda.
