Vulnerability in BackupPC package (CVE-2009-3369)
Summary
CVE-2009-3369: CgiUserConfigEdit in BackupPC 3.1.0, when SSH keys and Rsync are in use in a multi-user environment, does not restrict users from the ClientNameAlias function, which allows remote authenticated users to read and write se... Affects backuppc versions < 3.1.0-8. Fixed in 3.1.0-8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BackupPC is a backup system that performs disk-based backups of Linux, Windows, and macOS systems. It utilizes SSH keys and Rsync for secure data transfer in a multi-user environment. However, a vulnerability has been identified in BackupPC version 3.1.0, which allows remote authenticated users to read and write sensitive files by manipulating the ClientNameAlias function.
Vulnerability Detail
The vulnerability (CVE-2009-3369) in BackupPC arises from a lack of restrictions on the ClientNameAlias function. This allows authenticated users to modify ClientNameAlias to match another system and gain unauthorized access to sensitive files. By exploiting this vulnerability, an attacker can potentially compromise the confidentiality and integrity of backup data. The vulnerability was first published on September 24, 2009, and affects BackupPC versions prior to 3.1.0-8.
How To Fix
Minimum fixed version
3.1.0-8
This is the first release that contains the fix.
sudo apt-get install --only-upgrade backuppcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is advised to apply the recommended fix by updating to the latest version of BackupPC.
Conclusion
The vulnerability in BackupPC (CVE-2009-3369) allows authenticated users to gain unauthorized access to sensitive files. To mitigate this risk, it is crucial to update BackupPC to version 3.1.0-8 or later. For further assistance and support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for backuppc →
FAQ
BackupPC is a disk-based backup system for Linux, Windows, and macOS systems.
The vulnerability allows authenticated users to read and write sensitive files, potentially compromising the confidentiality and integrity of backup data.
BackupPC versions prior to 3.1.0-8 are affected by this vulnerability.
To fix this vulnerability, update BackupPC to version 3.1.0-8 or later.
The updated version of BackupPC can be obtained from the official Debian repositories or the BackupPC project website.
Related vulnerabilities
Recent vulnerabilities recorded for backuppc.
