Headline
Ubuntu Security Notice USN-5966-1
Ubuntu Security Notice 5966-1 - Maher Azzouzi discovered an information disclosure vulnerability in the calcsize binary within amanda. calcsize is a suid binary owned by root that could possibly be used by a malicious local attacker to expose sensitive file system information. Maher Azzouzi discovered a privilege escalation vulnerability in the rundump binary within amanda. rundump is a suid binary owned by root that did not perform adequate sanitization of environment variables or commandline options and could possibly be used by a malicious local attacker to escalate privileges.
==========================================================================
Ubuntu Security Notice USN-5966-1
March 23, 2023
amanda vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 ESM
- Ubuntu 14.04 ESM
Summary:
Several security issues were fixed in amanda.
Software Description:
- amanda: Advanced Maryland Automatic Network Disk Archiver (Client)
Details:
Maher Azzouzi discovered an information disclosure vulnerability in the
calcsize binary within amanda. calcsize is a suid binary owned by root that
could possibly be used by a malicious local attacker to expose sensitive
file system information. (CVE-2022-37703)
Maher Azzouzi discovered a privilege escalation vulnerability in the
rundump binary within amanda. rundump is a suid binary owned by root that
did not perform adequate sanitization of environment variables or
commandline options and could possibly be used by a malicious local
attacker to escalate privileges. (CVE-2022-37704)
Maher Azzouzi discovered a privilege escalation vulnerability in the runtar
binary within amanda. runtar is a suid binary owned by root that did not
perform adequate sanitization of commandline options and could possibly be
used by a malicious local attacker to escalate privileges. (CVE-2022-37705)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.10:
amanda-client 1:3.5.1-9ubuntu0.1
Ubuntu 22.04 LTS:
amanda-client 1:3.5.1-8ubuntu1.1
Ubuntu 20.04 LTS:
amanda-client 1:3.5.1-2ubuntu0.1
Ubuntu 18.04 LTS:
amanda-client 1:3.5.1-1ubuntu0.1
Ubuntu 16.04 ESM:
amanda-client 1:3.3.6-4.1ubuntu0.1
Ubuntu 14.04 ESM:
amanda-client 1:3.3.3-2ubuntu1.1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-5966-1
CVE-2022-37703, CVE-2022-37704, CVE-2022-37705
Package Information:
https://launchpad.net/ubuntu/+source/amanda/1:3.5.1-9ubuntu0.1
https://launchpad.net/ubuntu/+source/amanda/1:3.5.1-8ubuntu1.1
https://launchpad.net/ubuntu/+source/amanda/1:3.5.1-2ubuntu0.1
https://launchpad.net/ubuntu/+source/amanda/1:3.5.1-1ubuntu0.1
Related news
Ubuntu Security Notice 5966-3 - USN-5966-1 fixed vulnerabilities in amanda. Unfortunately that update caused a regression and was reverted in USN-5966-2. This update provides security fixes for Ubuntu 22.10, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS and Ubuntu 18.04 LTS.
Ubuntu Security Notice 5966-2 - USN-5966-1 fixed vulnerabilities in amanda. Unfortunately it introduced a regression in GNUTAR-based backups. This update reverts all of the changes in amanda until a better fix is provided. Maher Azzouzi discovered an information disclosure vulnerability in the calcsize binary within amanda. calcsize is a suid binary owned by root that could possibly be used by a malicious local attacker to expose sensitive file system information.
In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use `opendir()` as root directly without checking the path, letting the attacker provide an arbitrary path.