Critical Command Injection Vulnerability in Amanda Package
Summary
DEBIAN-CVE-2016-10729: An issue was discovered in Amanda 3.3.1. Affects amanda versions < 1:3.3.9-1. Fixed in 1:3.3.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Amanda is an open-source backup solution that enables users to set up a single master backup server to back up multiple hosts. It is widely used for its flexibility and ability to manage backups across various platforms. However, a critical vulnerability has been identified in versions prior to 1:3.3.9-1, which allows users with backup privileges to exploit the system.
Vulnerability Detail
An issue was discovered in Amanda version 3.3.1, where a user with backup privileges can compromise a client installation. The vulnerability arises from the 'runtar' setuid root binary, which fails to validate additional arguments supplied after the '--create' option. This oversight allows users to manipulate commands and execute command injection as root, potentially leading to unauthorized access and control over the system.
How To Fix
Minimum fixed version
1:3.3.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade amandaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the 'runtar' binary by modifying its permissions to prevent unauthorized users from executing it. This can be done with the command: 'sudo chmod 750 /path/to/runtar'.
Conclusion
The Amanda package has a critical command injection vulnerability that can be exploited by users with backup privileges. It is essential to update to the patched version 1:3.3.9-1 to safeguard against potential attacks. Users should also consider implementing workarounds until they can apply the update.
See every vulnerability recorded for amanda →
FAQ
The vulnerability allows users with backup privileges to execute arbitrary commands as root, potentially compromising the entire system.
You can check your version of Amanda by running 'amanda --version' in the terminal. If it is below 1:3.3.9-1, it is vulnerable.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using a manifest file like package-lock.json. You can check your application for vulnerabilities at Vulert Scanner without signing up.
If an immediate update is not possible, implement the workaround by restricting access to the 'runtar' binary to mitigate the risk temporarily.
Detailed information can be found in the CVE report for DEBIAN-CVE-2016-10729, which outlines the specifics of the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for amanda.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.