Security update for amanda SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2023:0069-1 Final 1 1 2023-03-14T13:49:00Z current 2023-03-14T13:49:00Z 2023-03-14T13:49:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for amanda This update for amanda fixes the following issues: - CVE-2022-37704: fix privilege escalation via rundump (boo#1208033, gh#zmanda/amanda#195) - CVE-2022-37705: fix privilege escalation via runtar suid binary (boo#1208032, gh#zmanda/amanda#194) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2023-69 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/45FBXK7GXP7SESEIZZ6JOEP7VN2T37AM/ E-Mail link for openSUSE-SU-2023:0069-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1208032 SUSE Bug 1208032 https://bugzilla.suse.com/1208033 SUSE Bug 1208033 https://www.suse.com/security/cve/CVE-2022-37704/ SUSE CVE CVE-2022-37704 page https://www.suse.com/security/cve/CVE-2022-37705/ SUSE CVE CVE-2022-37705 page SUSE Package Hub 15 SP4 openSUSE Leap 15.4 amanda-3.5.1-bp154.3.3.1 amanda-3.5.1-bp154.3.3.1 as a component of SUSE Package Hub 15 SP4 amanda-3.5.1-bp154.3.3.1 as a component of openSUSE Leap 15.4 Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which may lead to escalation of privileges, denial of service, and information disclosure. CVE-2022-37704 SUSE Package Hub 15 SP4:amanda-3.5.1-bp154.3.3.1 openSUSE Leap 15.4:amanda-3.5.1-bp154.3.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/45FBXK7GXP7SESEIZZ6JOEP7VN2T37AM/ https://www.suse.com/security/cve/CVE-2022-37704.html CVE-2022-37704 https://bugzilla.suse.com/1208033 SUSE Bug 1208033 A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar with specific arguments that are controllable by the attacker. This program mishandles the arguments passed to tar binary (it expects that the argument name and value are separated with a space; however, separating them with an equals sign is also supported), CVE-2022-37705 SUSE Package Hub 15 SP4:amanda-3.5.1-bp154.3.3.1 openSUSE Leap 15.4:amanda-3.5.1-bp154.3.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/45FBXK7GXP7SESEIZZ6JOEP7VN2T37AM/ https://www.suse.com/security/cve/CVE-2022-37705.html CVE-2022-37705 https://bugzilla.suse.com/1208032 SUSE Bug 1208032 https://bugzilla.suse.com/1213701 SUSE Bug 1213701