The dump_resource function in dird/dird_conf.c in Bacula before 5.2.11 does not properly enforce ACL rules, which allows remote authenticated users to obtain resource dump information via unspecified vectors.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The dump_resource function in dird/dird_conf.c in Bacula before 5.2.11 does not properly enforce ACL     rules, which allows remote authenticated users to obtain resource dump information via unspecified     vectors. (CVE-2012-4430)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-201405-11 (Bacula: Information disclosure)

    Bacula does not properly enforce console access control lists.
  Impact :

    A remote authenticated attacker may be able to bypass restrictions to       obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

Make dump_resource respect console ACL's

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that bacula, a network backup service, does not properly enforce console ACLs. This could allow information about resources to be dumped by an otherwise-restricted client.

A security issue has been reported in Bacula, which can be exploited by malicious users to bypass certain security restrictions.

The security issue is caused due to an error within the implementation of console ACLs, which can be exploited to gain access to certain restricted functionality and e.g. dump resources.

ID	Name	Product	Family	Severity
217698	Linux Distros Unpatched Vulnerability : CVE-2012-4430	Nessus	Misc.	medium
74054	GLSA-201405-11 : Bacula: Information disclosure	Nessus	Gentoo Local Security Checks	medium
64083	Fedora 16 : bacula-5.0.3-33.fc16 (2012-14452)	Nessus	Fedora Local Security Checks	medium
62453	Debian DSA-2558-1 : bacula - information disclosure	Nessus	Debian Local Security Checks	medium
62105	FreeBSD : bacula -- Console ACL Bypass (143f6932-fedb-11e1-ad4a-003067b2972c)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2012-4430

medium

Tenable Plugins

medium

medium

medium

medium

medium