Vulmon
Amazon Linux AMI Security Advisory: ALAS-2023-1808
Advisory Release Date: 2023-08-17 11:39 Pacific
Advisory Updated Date: 2023-08-23 02:31 Pacific
Severity:
Medium
Issue Overview:
An issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client installation. The "runtar" setuid root binary does not check for additional arguments supplied after --create, allowing users to manipulate commands and perform command injection as root. (CVE-2016-10729)
AMANDA (Advanced Maryland Automatic Network Disk Archiver) before tag-community-3.5.4 mishandles argument checking for runtar.c, a different vulnerability than CVE-2022-37705. (CVE-2023-30577)
Affected Packages:
amanda
Issue Correction:
Run yum update amanda to update your system.
New Packages:
i686:
amanda-debuginfo-2.6.1p2-8.14.amzn1.i686
amanda-client-2.6.1p2-8.14.amzn1.i686
amanda-devel-2.6.1p2-8.14.amzn1.i686
amanda-2.6.1p2-8.14.amzn1.i686
amanda-server-2.6.1p2-8.14.amzn1.i686
src:
amanda-2.6.1p2-8.14.amzn1.src
x86_64:
amanda-server-2.6.1p2-8.14.amzn1.x86_64
amanda-client-2.6.1p2-8.14.amzn1.x86_64
amanda-devel-2.6.1p2-8.14.amzn1.x86_64
amanda-debuginfo-2.6.1p2-8.14.amzn1.x86_64
amanda-2.6.1p2-8.14.amzn1.x86_64