PT-2009-5888 · Unknown · Back In Time

Vincent Danen · CVE-2009-3611 · Publicado 2009-10-26 · Atualizado 2024-01-25

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Back In Time version 0.9.26

Description The issue allows local users to obtain sensitive information or interfere with backup integrity. This is due to the common/snapshots.py file changing certain permissions to 0777 before deleting files in an old backup snapshot, enabling users to read or modify these files.

Recommendations For version 0.9.26, consider restricting access to the common/snapshots.py file until a patch is available, or avoid using the affected backup functionality to minimize the risk of exploitation.

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2009-3611

Produtos afetados

Back In Time

Referências · 13

• https://osv.dev/vulnerability/CVE-2009-3611 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-3611 · Nota de Segurança
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=543785 · Nota
• http://ftp.debian.org/debian/pool/main/b/backintime/backintime_0.9.26-3.diff.gz · Correção
• http://bugs.gentoo.org/show_bug.cgi?id=289047 · Correção
• https://bugzilla.redhat.com/show_bug.cgi?id=520210 · Nota
• https://bugs.launchpad.net/ubuntu/+source/backintime/+bug/434256 · Nota
• https://redhat.com/archives/fedora-package-announce/2009-September/msg00821.html · Aviso do Fabricante
• http://marc.info/?l=oss-security&m=125553645511436&w=2 · Nota
• http://marc.info/?l=oss-security&m=125554894700336&w=2 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-3611 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2009-3611 · Aviso do Fabricante
• https://redhat.com/archives/fedora-package-announce/2009-September/msg00823.html · Aviso do Fabricante