Critical Buffer Overflow Vulnerability in AMANDA Package
Summary
DEBIAN-CVE-2002-0901: Multiple buffer overflows in Advanced Maryland Automatic Network Disk Archiver (AMANDA) 2.3.0.4 allow (1) remote attackers to execute arbitrary code via long commands to the amindexd daemon, or certain local users to exe... Affects amanda versions < 2.4.0b6-1. Fixed in 2.4.0b6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
AMANDA (Advanced Maryland Automatic Network Disk Archiver) is an open-source backup solution that enables users to set up a single master backup server to back up multiple hosts. It is widely used for its flexibility and ability to manage backups across various platforms. However, versions prior to 2.4.0b6-1 are susceptible to multiple buffer overflow vulnerabilities that can lead to severe security risks.
Vulnerability Detail
The vulnerability arises from multiple buffer overflows in AMANDA version 2.3.0.4, allowing remote attackers to execute arbitrary code through long commands sent to the amindexd daemon. Additionally, local users can exploit this vulnerability via long command line arguments in various AMANDA programs, including amcheck, amgetidx, amtrmidx, createindex-dump, and createindex-gnutar. This can lead to unauthorized access and potential system compromise.
How To Fix
Minimum fixed version
2.4.0b6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade amandaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the AMANDA services and limit the execution of the affected programs to trusted users only. This can be achieved by modifying user permissions and firewall settings to minimize exposure.
Conclusion
The buffer overflow vulnerabilities in the AMANDA package pose significant security risks that can be exploited by attackers. It is crucial for users to update to the latest patched version to safeguard their systems. Implementing workarounds and monitoring tools like Vulert can further enhance security.
See every vulnerability recorded for amanda →
FAQ
The buffer overflow vulnerability can allow attackers to execute arbitrary code, potentially leading to unauthorized access and system compromise.
You can check your version of AMANDA by running 'amanda --version' in the terminal. If it is below 2.4.0b6-1, it is vulnerable.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using a manifest file like package-lock.json.
If an immediate update is not possible, consider implementing strict access controls and monitoring for suspicious activity as a temporary measure.
Detailed information about this vulnerability can be found in the Debian CVE database or by visiting the Vulert playground at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for amanda.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.