Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which may lead to escalation of privileges, denial of service, and information disclosure.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3880 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3880-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Adrian Bunk     September 07, 2024                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : amanda     Version        : 1:3.5.1-7+deb11u1     CVE ID         : CVE-2022-37703 CVE-2022-37704 CVE-2022-37705 CVE-2023-30577     Debian Bug     : 1021017 1029829 1055253

    Multiple vulnerabilities have been fixed in the Amanda backup system.

    CVE-2022-37703

        Directory existence disclosure

    CVE-2022-37704

        Privilege escalation in rundump

    CVE-2022-37705

        Privilege escalation in runtar

    CVE-2023-30577

        Privilege escalation in runtar

    For Debian 11 bullseye, these problems have been fixed in version     1:3.5.1-7+deb11u1.

    We recommend that you upgrade your amanda packages.

    For the detailed security status of amanda please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/amanda

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - amanda: runtar: crafted arguments can lead to local privilege escalation (CVE-2022-37705)

  - In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can     abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use     `opendir()` as root directly without checking the path, letting the attacker provide an arbitrary path.
    (CVE-2022-37703)

  - Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at     /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which     may lead to escalation of privileges, denial of service, and information disclosure. (CVE-2022-37704)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5966-3 advisory.

    USN-5966-1 fixed vulnerabilities in amanda. Unfortunately that update caused a regression and was reverted     in USN-5966-2. This update provides security fixes for Ubuntu 22.10, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS     and Ubuntu 18.04 LTS.

    We apologize for the inconvenience.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-3d0619d767 advisory.

    Update to version 3.5.3, which contains fixes for three minor security issues as well as other minor     bugfixes.

    https://github.com/zmanda/amanda/releases/tag/tag-community-3.5.3

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-e295804b3d advisory.

    Update to version 3.5.3, which contains fixes for three minor security issues as well as other minor     bugfixes.

    https://github.com/zmanda/amanda/releases/tag/tag-community-3.5.3

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-1293196f34 advisory.

    Update to version 3.5.3, which contains fixes for three minor security issues as well as other minor     bugfixes.

    https://github.com/zmanda/amanda/releases/tag/tag-community-3.5.3

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5966-1 advisory.

    Maher Azzouzi discovered an information disclosure vulnerability in the calcsize binary within amanda.
    calcsize is a suid binary owned by root that could possibly be used by a malicious local attacker to     expose sensitive file system information. (CVE-2022-37703)

    Maher Azzouzi discovered a privilege escalation vulnerability in the rundump binary within amanda. rundump     is a suid binary owned by root that did not perform adequate sanitization of environment variables or     commandline options and could possibly be used by a malicious local attacker to escalate privileges.
    (CVE-2022-37704)

    Maher Azzouzi discovered a privilege escalation vulnerability in the runtar binary within amanda. runtar     is a suid binary owned by root that did not perform adequate sanitization of commandline options and could     possibly be used by a malicious local attacker to escalate privileges. (CVE-2022-37705)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0069-1 advisory.

  - A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root     privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar     with specific arguments that are controllable by the attacker. This program mishandles the arguments     passed to tar binary (it expects that the argument name and value are separated with a space; however,     separating them with an equals sign is also supported), (CVE-2022-37705)

  - Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at     /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which     may lead to escalation of privileges, denial of service, and information disclosure. (CVE-2022-37704)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3330 advisory.

  - Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at     /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which     may lead to escalation of privileges, denial of service, and information disclosure. (CVE-2022-37704)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
206763	Debian dla-3880 : amanda-client - security update	Nessus	Debian Local Security Checks	high
199150	RHEL 8 : amanda (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
173781	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : amanda regression (USN-5966-3)	Nessus	Ubuntu Local Security Checks	medium
173760	Fedora 38 : amanda (2023-3d0619d767)	Nessus	Fedora Local Security Checks	medium
173754	Fedora 37 : amanda (2023-e295804b3d)	Nessus	Fedora Local Security Checks	medium
173753	Fedora 36 : amanda (2023-1293196f34)	Nessus	Fedora Local Security Checks	medium
173253	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : amanda vulnerabilities (USN-5966-1)	Nessus	Ubuntu Local Security Checks	medium
172560	openSUSE 15 Security Update : amanda (openSUSE-SU-2023:0069-1)	Nessus	SuSE Local Security Checks	medium
171761	Debian DLA-3330-1 : amanda - LTS security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2022-37704

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium