CVE-2022-37703

In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can abuse this vulnerability to know if a direct...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use opendir() as root directly without checking the path, letting the attacker provide an arbitrary path.

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

ディストリビューション別の修正状況

各ディストリビューションが公開している、この CVE の修正パッケージ

Debian DEBIAN-CVE-2022-37703 amanda 修正版: 1:3.5.1-7+deb11u1

参照URL

advisory github.com
advisory lists.fedoraproject.org
advisory lists.fedoraproject.org
advisory lists.fedoraproject.org
advisory nvd.nist.gov
package github.com
web amanda.org
web bugs.gentoo.org
web github.com
web lists.debian.org
web lists.debian.org