CVE-2009-3369
Published: 24 September 2009
CgiUserConfigEdit in BackupPC 3.1.0, when SSH keys and Rsync are in use in a multi-user environment, does not restrict users from the ClientNameAlias function, which allows remote authenticated users to read and write sensitive files by modifying ClientNameAlias to match another system, then initiating a backup or restore.
Notes
| Author | Note |
|---|---|
| mdeslaur | debian patch is incomplete, see debian bug report |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
backuppc Launchpad, Ubuntu, Debian |
dapper |
Not vulnerable
(code not present)
|
| hardy |
Released
(3.0.0-4ubuntu1.1)
|
|
| intrepid |
Released
(3.1.0-3ubuntu2.1)
|
|
| jaunty |
Released
(3.1.0-4ubuntu1.1)
|
|
| upstream |
Released
(3.1.0-7)
|
|
|
Patches: vendor: http://patch-tracker.debian.org/patch/misc/view/backuppc/3.1.0-7/lib/BackupPC/CGI/EditConfig.pm |
||