PT-2005-3832 · Bacula · Bacula

Eric Romang · Publicado 2005-09-20 · Atualizado 2018-10-09 · CVE-2005-2995

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions bacula versions 1.36.3 and earlier

Description The issue allows local users to modify or read sensitive files via symlink attacks on the temporary file used by autoconf/randpass when openssl is not available, or the mtx.[PID] temporary file in mtx-changer.in.

Recommendations For bacula versions 1.36.3 and earlier, consider restricting access to the temporary files used by autoconf/randpass and mtx-changer.in to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2005-2995

Produtos afetados

Bacula

Referências · 8

• http://novell.com/linux/security/advisories/2005_22_sr.html · Aviso do Fabricante
• http://bugs.gentoo.org/show_bug.cgi?id=104986 · Correção
• http://marc.info/?l=full-disclosure&m=112721654126735&w=2 · Nota
• https://osv.dev/vulnerability/CVE-2005-2995 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-2995 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-2995 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2005-2995 · Aviso do Fabricante
• http://zataz.net/adviso/bacula-09192005.txt · Correção