CVE-2012-4430 The dump_resource function in dird/dird_conf.c in Bacula before 5.2.11 does not properly enforce ACL rules, which allows remote authenticated users to obtain resource dump information via unspecified....
MediumCVSS 4.0
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The dump_resource function in dird/dird_conf.c in Bacula before 5.2.11 does not properly enforce ACL rules, which allows remote authenticated users to obtain resource dump information via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/bacula(Debian:12) | < 5.2.6+dfsg-4 | 5.2.6+dfsg-4 |
| debian/bacula(Debian:13) | < 5.2.6+dfsg-4 | 5.2.6+dfsg-4 |
| debian/bacula(Debian:14) | < 5.2.6+dfsg-4 | 5.2.6+dfsg-4 |
| bacula | < 5.2.11 | 5.2.11 |
| debian linux | = 6.0 | No fix listed |
| debian linux | = 7.0 | No fix listed |
References
- Debian Security Tracker CVE-2012-4430 vendor-advisory
- 50535 third-party-advisory
- 50808 third-party-advisory
- sourceforge.net third-party-advisory
- www.bacula.org vendor-advisory
- www.bacula.org patch vendor-advisory
- DSA-2558 third-party-advisory vendor-advisory
- MDVSA-2012:166 third-party-advisory vendor-advisory
- [oss-security] 20120914 CVE request: bacula: Console ACL Bypass mailing-list third-party-advisory
- [oss-security] 20120914 Re: CVE request: bacula: Console ACL Bypass mailing-list third-party-advisory
- [oss-security] 20120914 Re: Re: CVE request: bacula: Console ACL Bypass mailing-list third-party-advisory
- 55505 third-party-advisory vdb-entry
- bugs.debian.org issue-tracking