PT-2009-5888 · Unknown · Back In Time

Vincent Danen · CVE-2009-3611 · Published 2009-10-26 · Updated 2024-01-25

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Back In Time version 0.9.26

Description The issue allows local users to obtain sensitive information or interfere with backup integrity. This is due to the common/snapshots.py file changing certain permissions to 0777 before deleting files in an old backup snapshot, enabling users to read or modify these files.

Recommendations For version 0.9.26, consider restricting access to the common/snapshots.py file until a patch is available, or avoid using the affected backup functionality to minimize the risk of exploitation.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2009-3611

Affected Products

Back In Time

References · 13

• https://osv.dev/vulnerability/CVE-2009-3611 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3611 · Security Note
• http://ftp.debian.org/debian/pool/main/b/backintime/backintime_0.9.26-3.diff.gz · Patch
• http://bugs.gentoo.org/show_bug.cgi?id=289047 · Patch
• https://redhat.com/archives/fedora-package-announce/2009-September/msg00821.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-3611 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-3611 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-September/msg00823.html · Vendor Advisory
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=543785 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=520210 · Note
• https://bugs.launchpad.net/ubuntu/+source/backintime/+bug/434256 · Note
• http://marc.info/?l=oss-security&m=125553645511436&w=2 · Note
• http://marc.info/?l=oss-security&m=125554894700336&w=2 · Note