Privilege Escalation Vulnerability in Amanda Package: CVE-2022-37704
Summary
CVE-2022-37704: Amanda 3.5.1 allows privilege escalation from the regular user backup to root. Affects amanda across 2 version ranges.
< 1:3.5.1-7+deb11u1
< 60032f14aeefe63d2b92e01496667315430c5923
Fixed in 1:3.5.1-7+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Amanda is an open-source backup solution that enables users to set up a single master backup server to back up multiple hosts. It is widely used for its flexibility and ability to manage backups across different systems. However, the version 3.5.1 of Amanda has a critical vulnerability that allows privilege escalation from a regular user to root, potentially compromising the entire system.
Vulnerability Detail
The vulnerability arises from a SUID binary located at /lib/amanda/rundump, which executes /usr/sbin/dump as root. An attacker can control the arguments passed to this binary, leading to privilege escalation, denial of service, and information disclosure. This flaw is particularly dangerous as it allows unauthorized users to gain root access, which can be exploited for malicious purposes.
How To Fix
Minimum fixed version
1:3.5.1-7+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade amandaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can remove the SUID bit from the rundump binary to prevent it from executing with elevated privileges. Use the following command:
sudo chmod u-s /lib/amanda/rundump
This will mitigate the risk until the package is updated.
Conclusion
CVE-2022-37704 is a critical vulnerability in the Amanda backup software that allows privilege escalation. It is essential to update the software to the latest version to protect against potential exploits. Additionally, users can implement temporary workarounds to mitigate risks until updates are applied.
See every vulnerability recorded for amanda →
FAQ
CVE-2022-37704 is a vulnerability in the Amanda backup software that allows privilege escalation from a regular user to root.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The vulnerability can lead to unauthorized root access, denial of service, and information disclosure, posing significant risks to system security.
Yes, patches are available for different Debian versions. Ensure to update to the specified fixed versions to mitigate the risk.
The CVSS score of CVE-2022-37704 is 6.7, indicating a medium severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for amanda.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.