Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2018:4121-1

Опубликовано: 14 дек. 2018
Источник: suse-cvrf

Описание

Security update for amanda

This update for amanda fixes the following issues:

Security issue fixed:

  • CVE-2016-10729: Fixed a local privilege escalation from amanda to root via unsafe tar command options (bsc#1112916).

Список пакетов

SUSE Linux Enterprise Server 11 SP4
amanda-2.5.2.1-188.5.1
SUSE Linux Enterprise Server for SAP Applications 11 SP4
amanda-2.5.2.1-188.5.1

Ссылки

Описание

An issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client installation. The "runtar" setuid root binary does not check for additional arguments supplied after --create, allowing users to manipulate commands and perform command injection as root.

Затронутые продукты
SUSE Linux Enterprise Server 11 SP4:amanda-2.5.2.1-188.5.1
SUSE Linux Enterprise Server for SAP Applications 11 SP4:amanda-2.5.2.1-188.5.1
Ссылки