PT-2009-5676 · Backuppc · Backuppc

David Ambrose-Griffith · Publicado 2009-09-24 · Atualizado 2025-09-08 · CVE-2009-3369

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions BackupPC version 3.1.0

Description The issue allows remote authenticated users to read and write sensitive files by modifying the ClientNameAlias function to match another system and then initiating a backup or restore. This is possible when SSH keys and Rsync are in use in a multi-user environment.

Recommendations For BackupPC version 3.1.0, restrict access to the ClientNameAlias function to prevent users from modifying it and gaining unauthorized access to sensitive files. As a temporary workaround, consider disabling the ClientNameAlias function until a patch is available.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2009-3369

Produtos afetados

Backuppc

Referências · 13

• http://secunia.com/advisories/37161 · Nota
• https://t.me/cveNotify/134644 · Publicação no Telegram
• http://secunia.com/advisories/36393 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3369 · Nota
• http://osvdb.org/57236 · Nota
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=542218 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=518412 · Nota
• https://redhat.com/archives/fedora-package-announce/2009-October/msg00694.html · Aviso do Fabricante
• https://redhat.com/archives/fedora-package-announce/2009-October/msg00729.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2009-3369 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-3369 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-3369 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2009-3369 · Aviso do Fabricante