PT-2017-2799 · Replibit · Replibit Backup Manager

Michael Allen · Published 2017-08-11 · Updated 2020-05-28 · CVE-2017-13707

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Replibit Backup Manager versions prior to 2017.08.04

Description The issue concerns a privilege escalation that allows attackers to gain root privileges. This is achieved through the execution of sudo commands, which can be used to access the vi program and navigate the filesystem. The vulnerability enables modification of critical files, such as /etc/passwd, potentially compromising system integrity. The issue is related to insufficient access control in the vi service of the Backup Manager script set.

Recommendations For Replibit Backup Manager versions prior to 2017.08.04, update to version 2017.08.04 or later to resolve the issue. As a temporary workaround, consider restricting access to the vi program and limiting the use of sudo commands to minimize the risk of exploitation.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-264

CWE-269

Related Identifiers

BDU:2017-02066

CVE-2017-13707

Affected Products

Replibit Backup Manager

References · 4

• 🔥 https://github.com/Wh1t3Rh1n0/exploits/blob/master/2017-08-25%20Replibit%20Backup%20Manager/README.md · Exploit
• https://bdu.fstec.ru/vul/2017-02066 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-13707 · Security Note
• https://osv.dev/vulnerability/CVE-2017-13707 · Vendor Advisory