Critical Vulnerability in Amanda Package: User Privilege Escalation Risk
Summary
DEBIAN-CVE-2016-10730: An issue was discovered in Amanda 3.3.1. Affects amanda versions < 1:3.3.9-1. Fixed in 1:3.3.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Amanda is an open-source backup solution that enables users to manage and automate the backup of data across various systems. It is widely used for its flexibility and ability to handle multiple backup types. However, a significant vulnerability has been identified in versions prior to 1:3.3.9-1, which allows users with backup privileges to compromise client installations, posing a serious security risk.
Vulnerability Detail
An issue was discovered in Amanda 3.3.1 where a user with backup privileges can easily compromise a client installation. The vulnerability arises from the Amstar script, which is part of the Amanda Application API. This script should not be executed directly by users as it utilizes the 'star' command to perform backup and restore operations. The script runs binaries with root permissions based on the command line argument '--star-path', which can be manipulated by an attacker to execute arbitrary commands with elevated privileges.
How To Fix
Minimum fixed version
1:3.3.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade amandaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid running the Amstar script directly and ensure that only trusted users have backup privileges. Additionally, restricting access to the '--star-path' argument can help mitigate the risk until the package is updated.
Conclusion
The Amanda package has a critical vulnerability that allows users with backup privileges to compromise client installations. It is crucial to update to the patched version 1:3.3.9-1 to mitigate this risk. Users should also consider using Vulert for ongoing monitoring of vulnerabilities in their software.
See every vulnerability recorded for amanda →
FAQ
The vulnerability allows users with backup privileges to execute arbitrary commands with root permissions, potentially compromising the entire client installation.
You can check your version of Amanda by running 'amanda --version' in the terminal. If it is below 1:3.3.9-1, it is vulnerable.
If an immediate update is not possible, restrict access to the Amstar script and limit backup privileges to trusted users as a temporary measure.
Yes, Vulert can monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for amanda.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.