PT-2018-4896 · Zmanda · Amanda

Hacker Fantastic · Publicado 2018-10-24 · Atualizado 2019-01-09 · CVE-2016-10730

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Amanda version 3.3.1

Description An issue was discovered that allows a user with backup privileges to compromise a client installation. The Amstar script, which is part of the Amanda Application API, should not be run directly by users. It utilizes the star utility for backup and restore operations and executes binaries with root permissions when parsing the --star-path command line argument.

Recommendations For Amanda version 3.3.1, consider restricting access to the Amstar script to prevent direct execution by users, and ensure that the --star-path argument is properly validated to prevent unauthorized execution of binaries with root permissions.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2016-10730

Produtos afetados

Amanda

Referências · 8

• 🔥 https://exploit-db.com/exploits/39244 · Exploit
• https://osv.dev/vulnerability/CVE-2016-10730 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-10730 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2016-10730 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2016-10730 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-10730 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-10730 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-10730 · Aviso do Fabricante