PT-2005-3832 · Bacula · Bacula

Eric Romang · Published 2005-09-20 · Updated 2018-10-09 · CVE-2005-2995

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions bacula versions 1.36.3 and earlier

Description The issue allows local users to modify or read sensitive files via symlink attacks on the temporary file used by autoconf/randpass when openssl is not available, or the mtx.[PID] temporary file in mtx-changer.in.

Recommendations For bacula versions 1.36.3 and earlier, consider restricting access to the temporary files used by autoconf/randpass and mtx-changer.in to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-2995

Affected Products

Bacula

References · 8

• http://novell.com/linux/security/advisories/2005_22_sr.html · Vendor Advisory
• http://bugs.gentoo.org/show_bug.cgi?id=104986 · Patch
• https://osv.dev/vulnerability/CVE-2005-2995 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-2995 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-2995 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2005-2995 · Vendor Advisory
• http://zataz.net/adviso/bacula-09192005.txt · Patch
• http://marc.info/?l=full-disclosure&m=112721654126735&w=2 · Note