CVE-2022-37705 — Argument Injection in Amanda
Severity
7.8HIGHNVD
NVD6.7OSV6.7OSV3.3
EPSS
3.6%
top 12.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedApr 16
Latest updateJul 26
Description
A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar with specific arguments that are controllable by the attacker. This program mishandles the arguments passed to tar binary (it expects that the argument name and value are separated with a space; however, separating them with an equals sign is also supported),
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9
Affected Packages4 packages
Patches
🔴Vulnerability Details
6OSV▶
CVE-2023-30577: AMANDA (Advanced Maryland Automatic Network Disk Archiver) before tag-community-3↗2023-07-26