CVE-2016-10729 An issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client installation. The "runtar" setuid root binary does not check for additional arguments supplied....
HighCVSS 7.8
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client installation. The "runtar" setuid root binary does not check for additional arguments supplied after --create, allowing users to manipulate commands and perform command injection as root.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/amanda(Debian:12) | < 1:3.3.9-1 | 1:3.3.9-1 |
| debian/amanda(Debian:13) | < 1:3.3.9-1 | 1:3.3.9-1 |
| debian/amanda(Debian:14) | < 1:3.3.9-1 | 1:3.3.9-1 |
| zmanda amanda | = 3.3.1 | No fix listed |
| redhat enterprise linux | = 7.0 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| debian linux | = 10.0 | No fix listed |
References
- Debian Security Tracker CVE-2016-10729 vendor-advisory
- 39217 exploit third-party-advisory vdb-entry