VDB
CVE-2022-37704
CVE-2022-37704
PUBLISHED
CVSS 7.800000190734863 HIGH
Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which may lead to escalation of privileges, denial of service, and information disclosure.
EPSS 0.53% · 44.6th percentile
Risk Scores
CVSS 3.1
7.800000190734863
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.53%
44.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| zmanda | amanda | 3.5.1 |
| n/a | n/a | * |
Timeline
- Mar 14, 2023 CVE Published
- Apr 16, 2023 EPSS Score
- May 24, 2023 EPSS Score
- Jul 2, 2023 EPSS Score
- Sep 17, 2023 EPSS Score
- Oct 25, 2023 EPSS Score
- Dec 3, 2023 EPSS Score
- Jan 10, 2024 EPSS Score
- Mar 27, 2024 EPSS Score
- May 4, 2024 EPSS Score
- Jun 12, 2024 EPSS Score
- Jul 20, 2024 EPSS Score
References
- [debian-lts-announce] 20230221 [SECURITY] [DLA 3330-1] amanda security update advisory
- https://github.com/zmanda/amanda/pull/205 fix
- https://github.com/zmanda/amanda/releases/tag/tag-community-3.5.3 fix
- https://lists.debian.org/debian-lts-announce/2024/09/msg00023.html advisory
- https://github.com/zmanda/amanda/issues/192 discussion
- https://github.com/zmanda/amanda/pull/197 fix
- http://www.amanda.org/ url
- https://github.com/MaherAzzouzi/CVE-2022-37704 url
- https://marc.info/?l=amanda-hackers url
- FEDORA-2023-3d0619d767 vendor-advisory
- FEDORA-2023-1293196f34 vendor-advisory
- FEDORA-2023-e295804b3d vendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-37704 advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5DCLSX5YYTWMKSMDL67M5STZ5ZDSOXK url
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ATMGMVS3QDN6OMKMHGUTUTU7NS7HR3BZ url
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JYREA6LFXF5M7K4WLNJV5VNQPS4MTBW2 url
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5DCLSX5YYTWMKSMDL67M5STZ5ZDSOXK url
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ATMGMVS3QDN6OMKMHGUTUTU7NS7HR3BZ url
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JYREA6LFXF5M7K4WLNJV5VNQPS4MTBW2 url
- http://www.amanda.org url