PT-2002-1911 · University Of Maryland · Amanda

Publicado 2002-08-31 · Atualizado 2008-09-05 · CVE-2002-0901

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Advanced Maryland Automatic Network Disk Archiver (AMANDA) version 2.3.0.4

Description: The issue concerns buffer overflows that can be exploited by remote attackers to execute arbitrary code via long commands to the amindexd daemon. Additionally, certain local users can execute arbitrary code via long command line arguments to specific programs, including amcheck, amgetidx, amtrmidx, createindex-dump, and createindex-gnutar.

Recommendations: For Advanced Maryland Automatic Network Disk Archiver (AMANDA) version 2.3.0.4, consider restricting access to the amindexd daemon and limiting the use of long command line arguments for the affected programs as a temporary mitigation measure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2002-0901

Produtos afetados

Amanda

Referências · 9

• http://iss.net/security_center/static/9182.php · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2002-0901 · Aviso do Fabricante
• http://iss.net/security_center/static/9181.php · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2002-0901 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2002-0901 · Nota de Segurança
• http://securityfocus.com/bid/4836 · Aviso do Fabricante
• http://securityfocus.com/bid/4840 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2002-0901 · Aviso do Fabricante
• http://online.securityfocus.com/archive/1/274215 · Nota