Open Source Vulnerability in Amanda Package (CVE-2016-10730)
Summary
CVE-2016-10730: An issue was discovered in Amanda 3.3.1. Affects amanda versions < 1:3.3.9-1. Fixed in 1:3.3.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Amanda is an open-source backup and recovery software package that allows users to easily back up and restore their data. It is commonly used in Debian-based systems. However, a vulnerability has been discovered in Amanda version 3.3.1, which allows a user with backup privileges to compromise a client installation. This vulnerability exists due to the improper handling of command line arguments in the Amstar script, which runs binaries with root permissions. This issue can have severe consequences for the security and integrity of the backed-up data.
Vulnerability Detail
The vulnerability (CVE-2016-10730) in Amanda 3.3.1 allows an attacker with backup privileges to exploit the Amstar script, which should not be run directly by users. By manipulating the command line argument --star-path, an attacker can execute arbitrary binaries with root permissions. This can lead to unauthorized access, data manipulation, or even complete system compromise. The severity of this vulnerability is rated as high (CVSS score: 7.8).
How To Fix
Minimum fixed version
1:3.3.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade amandaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can avoid running the Amstar script directly and instead rely on the recommended backup and restore procedures provided by Amanda. By following the official documentation and guidelines, users can minimize the risk of exploitation through this vulnerability.
Conclusion
The vulnerability in Amanda version 3.3.1 (CVE-2016-10730) poses a significant risk to the security and integrity of backup and recovery processes. Users with backup privileges on client installations should upgrade to version 3.3.9-1 or later to address this vulnerability. It is recommended to follow the official documentation and guidelines provided by Amanda to ensure the safe and secure backup of data. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for amanda →
FAQ
This vulnerability allows an attacker with backup privileges to execute arbitrary binaries with root permissions, potentially leading to unauthorized access, data manipulation, or system compromise.
Users of Amanda version 3.3.1 are affected by this vulnerability. Specifically, those with backup privileges on client installations are at risk.
At the time of this report, there are no known public exploits targeting this vulnerability. However, it is important to apply the recommended fix to mitigate the risk.
No, this vulnerability requires an attacker to have backup privileges on the affected client installation. It cannot be exploited remotely without prior access.
There is no evidence of active exploitation of this vulnerability at the time of this report. However, it is crucial to apply the fix to prevent any potential future exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for amanda.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.