Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2018:3804-1

Опубликовано: 16 нояб. 2018
Источник: suse-cvrf

Описание

Security update for amanda

This update for amanda fixes the following security issue:

  • CVE-2016-10729: Local privilege escalation from amanda user to root via unsafe tar command options (bsc#1112916)

Список пакетов

openSUSE Leap 42.3
amanda-3.3.6-10.3.1

Ссылки

Описание

An issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client installation. The "runtar" setuid root binary does not check for additional arguments supplied after --create, allowing users to manipulate commands and perform command injection as root.

Затронутые продукты
openSUSE Leap 42.3:amanda-3.3.6-10.3.1
Ссылки