The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-1293196f34 advisory.

  - In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can     abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use     `opendir()` as root directly without checking the path, letting the attacker provide an arbitrary path.
    (CVE-2022-37703)

  - Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at     /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which     may lead to escalation of privileges, denial of service, and information disclosure. (CVE-2022-37704)

  - A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root     privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar     with specific arguments that are controllable by the attacker. This program mishandles the arguments     passed to tar binary (it expects that the argument name and value are separated with a space; however,     separating them with an equals sign is also supported), (CVE-2022-37705)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-3d0619d767 advisory.

  - In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can     abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use     `opendir()` as root directly without checking the path, letting the attacker provide an arbitrary path.
    (CVE-2022-37703)

  - Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at     /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which     may lead to escalation of privileges, denial of service, and information disclosure. (CVE-2022-37704)

  - A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root     privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar     with specific arguments that are controllable by the attacker. This program mishandles the arguments     passed to tar binary (it expects that the argument name and value are separated with a space; however,     separating them with an equals sign is also supported), (CVE-2022-37705)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - amanda: runtar: crafted arguments can lead to local privilege escalation (CVE-2022-37705)

  - In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can     abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use     `opendir()` as root directly without checking the path, letting the attacker provide an arbitrary path.
    (CVE-2022-37703)

  - Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at     /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which     may lead to escalation of privileges, denial of service, and information disclosure. (CVE-2022-37704)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0069-1 advisory.

  - A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root     privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar     with specific arguments that are controllable by the attacker. This program mishandles the arguments     passed to tar binary (it expects that the argument name and value are separated with a space; however,     separating them with an equals sign is also supported), (CVE-2022-37705)

  - Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at     /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which     may lead to escalation of privileges, denial of service, and information disclosure. (CVE-2022-37704)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 22.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5966-1 advisory.

  - In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can     abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use     `opendir()` as root directly without checking the path, letting the attacker provide an arbitrary path.
    (CVE-2022-37703)

  - Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at     /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which     may lead to escalation of privileges, denial of service, and information disclosure. (CVE-2022-37704)

  - A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root     privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar     with specific arguments that are controllable by the attacker. This program mishandles the arguments     passed to tar binary (it expects that the argument name and value are separated with a space; however,     separating them with an equals sign is also supported), (CVE-2022-37705)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3681 advisory.

  - In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can     abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use     `opendir()` as root directly without checking the path, letting the attacker provide an arbitrary path.
    (CVE-2022-37703)

  - A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root     privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar     with specific arguments that are controllable by the attacker. This program mishandles the arguments     passed to tar binary (it expects that the argument name and value are separated with a space; however,     separating them with an equals sign is also supported), (CVE-2022-37705)

  - AMANDA (Advanced Maryland Automatic Network Disk Archiver) before tag-community-3.5.4 mishandles argument     checking for runtar.c, a different vulnerability than CVE-2022-37705. (CVE-2023-30577)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-e295804b3d advisory.

  - In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can     abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use     `opendir()` as root directly without checking the path, letting the attacker provide an arbitrary path.
    (CVE-2022-37703)

  - Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at     /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which     may lead to escalation of privileges, denial of service, and information disclosure. (CVE-2022-37704)

  - A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root     privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar     with specific arguments that are controllable by the attacker. This program mishandles the arguments     passed to tar binary (it expects that the argument name and value are separated with a space; however,     separating them with an equals sign is also supported), (CVE-2022-37705)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 22.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5966-3 advisory.

  - In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can     abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use     `opendir()` as root directly without checking the path, letting the attacker provide an arbitrary path.
    (CVE-2022-37703)

  - local privilege escalation [fedora-all] (CVE-2022-37704)

  - crafted arguments to the runtar SUID binary leads to local privilege escalation to root [fedora-all]     (CVE-2022-37705)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
173753	Fedora 36 : amanda (2023-1293196f34)	Nessus	Fedora Local Security Checks	4/2/2023	4/29/2024	medium
173760	Fedora 38 : amanda (2023-3d0619d767)	Nessus	Fedora Local Security Checks	4/2/2023	4/29/2024	medium
199150	RHEL 8 : amanda (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	medium
172560	openSUSE 15 Security Update : amanda (openSUSE-SU-2023:0069-1)	Nessus	SuSE Local Security Checks	3/15/2023	8/30/2023	medium
173253	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : amanda vulnerabilities (USN-5966-1)	Nessus	Ubuntu Local Security Checks	3/22/2023	10/16/2023	medium
186524	Debian DLA-3681-1 : amanda - LTS security update	Nessus	Debian Local Security Checks	12/3/2023	12/3/2023	high
173754	Fedora 37 : amanda (2023-e295804b3d)	Nessus	Fedora Local Security Checks	4/2/2023	4/29/2024	medium
173781	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : amanda regression (USN-5966-3)	Nessus	Ubuntu Local Security Checks	4/3/2023	10/20/2023	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

high

medium

medium