PT-2009-5676 · Backuppc · Backuppc

David Ambrose-Griffith · Published 2009-09-24 · Updated 2025-09-08 · CVE-2009-3369

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions BackupPC version 3.1.0

Description The issue allows remote authenticated users to read and write sensitive files by modifying the ClientNameAlias function to match another system and then initiating a backup or restore. This is possible when SSH keys and Rsync are in use in a multi-user environment.

Recommendations For BackupPC version 3.1.0, restrict access to the ClientNameAlias function to prevent users from modifying it and gaining unauthorized access to sensitive files. As a temporary workaround, consider disabling the ClientNameAlias function until a patch is available.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-3369

Affected Products

Backuppc

References · 13

• http://secunia.com/advisories/36393 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-October/msg00694.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-October/msg00729.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-3369 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3369 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-3369 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-3369 · Vendor Advisory
• http://secunia.com/advisories/37161 · Note
• https://t.me/cveNotify/134644 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3369 · Note
• http://osvdb.org/57236 · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=542218 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=518412 · Note