Amanda · Amanda · CVE-2022-37703
**Name of the Vulnerable Software and Affected Versions**
Amanda version 3.5.1
**Description**
An information leak issue was discovered in the calcsize SUID binary, allowing an attacker to determine if a directory exists anywhere in the file system. The binary uses the `opendir()` function as root without path validation, enabling an attacker to provide an arbitrary path.
**Recommendations**
For Amanda version 3.5.1, consider restricting access to the calcsize SUID binary until a patch is available, or apply configuration changes to limit the binary's ability to access arbitrary paths. As a temporary workaround, consider disabling the use of the `opendir()` function in the calcsize binary to minimize the risk of exploitation.