PT-2002-1911 · University Of Maryland · Amanda

Published 2002-08-31 · Updated 2008-09-05 · CVE-2002-0901

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Advanced Maryland Automatic Network Disk Archiver (AMANDA) version 2.3.0.4

Description: The issue concerns buffer overflows that can be exploited by remote attackers to execute arbitrary code via long commands to the amindexd daemon. Additionally, certain local users can execute arbitrary code via long command line arguments to specific programs, including amcheck, amgetidx, amtrmidx, createindex-dump, and createindex-gnutar.

Recommendations: For Advanced Maryland Automatic Network Disk Archiver (AMANDA) version 2.3.0.4, consider restricting access to the amindexd daemon and limiting the use of long command line arguments for the affected programs as a temporary mitigation measure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2002-0901

Affected Products

Amanda

References · 9

• http://iss.net/security_center/static/9182.php · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2002-0901 · Vendor Advisory
• http://iss.net/security_center/static/9181.php · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2002-0901 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0901 · Security Note
• http://securityfocus.com/bid/4836 · Vendor Advisory
• http://securityfocus.com/bid/4840 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2002-0901 · Vendor Advisory
• http://online.securityfocus.com/archive/1/274215 · Note