CVE-2022-37703

In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can abuse this vulnerability to know if a direct...

Original description

The description as published by the source.

In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use opendir() as root directly without checking the path, letting the attacker provide an arbitrary path.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2022-37703 amanda Fixed in: 1:3.5.1-7+deb11u1

References

advisory github.com
advisory lists.fedoraproject.org
advisory lists.fedoraproject.org
advisory lists.fedoraproject.org
advisory nvd.nist.gov
package github.com
web amanda.org
web bugs.gentoo.org
web github.com
web lists.debian.org
web lists.debian.org