CVE-2007-5626 make_catalog_backup in Bacula 2.2.5, and probably earlier, sends a MySQL password as a command line argument, and sometimes transmits cleartext e-mail containing this command line, which allows contex...
MediumCVSS 5.5
EPSS 0.29%
- Published
- Updated
- Exploit status
- No public exploit known
Description
make_catalog_backup in Bacula 2.2.5, and probably earlier, sends a MySQL password as a command line argument, and sometimes transmits cleartext e-mail containing this command line, which allows context-dependent attackers to obtain the password by listing the process and its arguments, or by sniffing the network.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bacula | <= 2.2.5 | No fix listed |
| debian/bacula(Debian:12) | < 5.0.0-1 | 5.0.0-1 |
| debian/bacula(Debian:13) | < 5.0.0-1 | 5.0.0-1 |
| debian/bacula(Debian:14) | < 5.0.0-1 | 5.0.0-1 |
References
- bugs.bacula.org permissions-required vendor-advisory
- bugs.debian.org issue-tracking mailing-list third-party-advisory
- 41861 broken-link vdb-entry
- 27243 broken-link third-party-advisory
- 31184 broken-link third-party-advisory
- GLSA-200807-10 third-party-advisory vendor-advisory
- 26156 broken-link third-party-advisory vdb-entry
- ADV-2007-3572 broken-link permissions-required third-party-advisory vdb-entry
- bacula-makecatalogbackup-info-disclosure(37336) third-party-advisory vdb-entry
- Debian Security Tracker CVE-2007-5626 vendor-advisory
- bugs.debian.org issue-tracking