Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which may lead to escalation of privileges, denial of service, and information disclosure.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - amanda: Improper argument checking for runtar.c (CVE-2023-30577)

  - In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can     abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use     `opendir()` as root directly without checking the path, letting the attacker provide an arbitrary path.
    (CVE-2022-37703)

  - Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at     /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which     may lead to escalation of privileges, denial of service, and information disclosure. (CVE-2022-37704)

  - A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root     privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar     with specific arguments that are controllable by the attacker. This program mishandles the arguments     passed to tar binary (it expects that the argument name and value are separated with a space; however,     separating them with an equals sign is also supported), (CVE-2022-37705)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - amanda: Privilege escalation in amstar and amgtar via --*tar-path option (CVE-2016-10730)

  - amanda: Improper argument checking for runtar.c (CVE-2023-30577)

  - An issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client     installation. The runtar setuid root binary does not check for additional arguments supplied after
    --create, allowing users to manipulate commands and perform command injection as root. (CVE-2016-10729)

  - In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can     abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use     `opendir()` as root directly without checking the path, letting the attacker provide an arbitrary path.
    (CVE-2022-37703)

  - Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at     /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which     may lead to escalation of privileges, denial of service, and information disclosure. (CVE-2022-37704)

  - A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root     privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar     with specific arguments that are controllable by the attacker. This program mishandles the arguments     passed to tar binary (it expects that the argument name and value are separated with a space; however,     separating them with an equals sign is also supported), (CVE-2022-37705)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 22.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5966-3 advisory.

  - In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can     abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use     `opendir()` as root directly without checking the path, letting the attacker provide an arbitrary path.
    (CVE-2022-37703)

  - local privilege escalation [fedora-all] (CVE-2022-37704)

  - crafted arguments to the runtar SUID binary leads to local privilege escalation to root [fedora-all]     (CVE-2022-37705)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-3d0619d767 advisory.

  - In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can     abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use     `opendir()` as root directly without checking the path, letting the attacker provide an arbitrary path.
    (CVE-2022-37703)

  - Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at     /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which     may lead to escalation of privileges, denial of service, and information disclosure. (CVE-2022-37704)

  - A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root     privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar     with specific arguments that are controllable by the attacker. This program mishandles the arguments     passed to tar binary (it expects that the argument name and value are separated with a space; however,     separating them with an equals sign is also supported), (CVE-2022-37705)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-e295804b3d advisory.

  - In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can     abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use     `opendir()` as root directly without checking the path, letting the attacker provide an arbitrary path.
    (CVE-2022-37703)

  - Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at     /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which     may lead to escalation of privileges, denial of service, and information disclosure. (CVE-2022-37704)

  - A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root     privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar     with specific arguments that are controllable by the attacker. This program mishandles the arguments     passed to tar binary (it expects that the argument name and value are separated with a space; however,     separating them with an equals sign is also supported), (CVE-2022-37705)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-1293196f34 advisory.

  - In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can     abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use     `opendir()` as root directly without checking the path, letting the attacker provide an arbitrary path.
    (CVE-2022-37703)

  - Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at     /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which     may lead to escalation of privileges, denial of service, and information disclosure. (CVE-2022-37704)

  - A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root     privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar     with specific arguments that are controllable by the attacker. This program mishandles the arguments     passed to tar binary (it expects that the argument name and value are separated with a space; however,     separating them with an equals sign is also supported), (CVE-2022-37705)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 22.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5966-1 advisory.

  - In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can     abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use     `opendir()` as root directly without checking the path, letting the attacker provide an arbitrary path.
    (CVE-2022-37703)

  - Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at     /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which     may lead to escalation of privileges, denial of service, and information disclosure. (CVE-2022-37704)

  - A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root     privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar     with specific arguments that are controllable by the attacker. This program mishandles the arguments     passed to tar binary (it expects that the argument name and value are separated with a space; however,     separating them with an equals sign is also supported), (CVE-2022-37705)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0069-1 advisory.

  - A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root     privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar     with specific arguments that are controllable by the attacker. This program mishandles the arguments     passed to tar binary (it expects that the argument name and value are separated with a space; however,     separating them with an equals sign is also supported), (CVE-2022-37705)

  - Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at     /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which     may lead to escalation of privileges, denial of service, and information disclosure. (CVE-2022-37704)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3330 advisory.

  - Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at     /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which     may lead to escalation of privileges, denial of service, and information disclosure. (CVE-2022-37704)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
196485	RHEL 6 : amanda (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
196389	RHEL 7 : amanda (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
173781	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : amanda regression (USN-5966-3)	Nessus	Ubuntu Local Security Checks	medium
173760	Fedora 38 : amanda (2023-3d0619d767)	Nessus	Fedora Local Security Checks	medium
173754	Fedora 37 : amanda (2023-e295804b3d)	Nessus	Fedora Local Security Checks	medium
173753	Fedora 36 : amanda (2023-1293196f34)	Nessus	Fedora Local Security Checks	medium
173253	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : amanda vulnerabilities (USN-5966-1)	Nessus	Ubuntu Local Security Checks	medium
172560	openSUSE 15 Security Update : amanda (openSUSE-SU-2023:0069-1)	Nessus	SuSE Local Security Checks	medium
171761	Debian DLA-3330-1 : amanda - LTS security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2022-37704

medium

Tenable Plugins

high

high

medium

medium

medium

medium

medium

medium

medium