Command Injection Vulnerability in Amanda
Summary
CVE-2016-10729: An issue was discovered in Amanda 3.3.1. Affects amanda versions < 1:3.3.9-1. Fixed in 1:3.3.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Amanda is an open-source backup and recovery software package that allows users to easily back up and restore their data. It is commonly used in Debian-based systems. However, a vulnerability has been discovered in Amanda version 3.3.1 that allows a user with backup privileges to compromise a client installation. This vulnerability exists in the "runtar" setuid root binary, which fails to properly check for additional arguments supplied after the --create option. This oversight enables users to manipulate commands and perform command injection as root.
Vulnerability Detail
The command injection vulnerability in Amanda version 3.3.1 arises from the lack of input validation in the "runtar" binary. By providing additional arguments after the --create option, an attacker with backup privileges can inject malicious commands that will be executed as root. This can lead to unauthorized access, data loss, or even complete system compromise. The severity of this vulnerability is rated as high, with a CVSS score of 7.8.
How To Fix
Minimum fixed version
1:3.3.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade amandaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Amanda is not immediately feasible, a temporary workaround can be implemented by removing the setuid root permission from the "runtar" binary. This can be achieved by running the following command:
chmod u-s /usr/lib/amanda/runtar
However, it is important to note that this workaround only removes the immediate risk and does not address the underlying vulnerability. Upgrading to the fixed version is still strongly recommended.
Conclusion
The command injection vulnerability in Amanda version 3.3.1 poses a significant risk to systems with backup privileges. It is crucial to upgrade to the fixed version (3.3.9-1 or later) or apply the temporary workaround to mitigate the risk. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for amanda →
FAQ
Amanda is an open-source backup and recovery software package used in Debian-based systems.
This vulnerability allows a user with backup privileges to execute arbitrary commands as root, potentially leading to unauthorized access, data loss, or system compromise.
To fix this vulnerability, upgrade to Amanda version 3.3.9-1 or later.
Yes, a temporary workaround is to remove the setuid root permission from the "runtar" binary.
The severity of this vulnerability is rated as high, with a CVSS score of 7.8.
Related vulnerabilities
Recent vulnerabilities recorded for amanda.
