CVE-2009-3611

First published: Fri Aug 28 2009(Updated: )

A Debian bug report [1] indicates that backintime chmods files to mode 0777 prior to removing them via removing a snapshot. What makes this worse is that if those files exist in subsequent snapshots, the permissions on those files is also mode 0777 which allows anyone to manipulate/delete the files in the backup. Looking at this further, if I set the backintime backup directory to, say /srv/backups/$USER, and were to have multiple users on the system, each user would be able to see the other's backup files. Granted, permissions are mimicked from the source, so if a file is 0644 at the source, it will be in the backup as well. However, I think it might be prudent if /srv/backups/$USER was also owned $USER:$USER and mode 0700. The file in question is common/snapshots.py which contains: 316 path = self.get_snapshot_path( snapshot_id ) 317 cmd = "chmod -R a+rwx "%s"" % path 318 self._execute( cmd ) 319 cmd = "rm -rfv "%s"" % path 320 self._execute( cmd ) I'm not sure what the logic behind chmoding those files in the first place is. Obviously the user had to have read-permissions to get the files into the backup in the first place so they should all be owned by the user, meaning chmodding the files is relatively useless. The debian report suggests changing the chmod call to a find call and just changing the mode of directories, but I'm not convinced that's even necessary if the directories are owned by the user to begin with. There are also two places where this call is made: % grep -r 'chmod -R a+rwx' * common/snapshots.py: cmd = "chmod -R a+rwx "%s"" % path common/snapshots.py: self._execute( "chmod -R a+rwx "%s"" % new_snapshot_path ) so the second invocation likely needs to be changed as well. This would affect Fedora 10, Fedora 11, and rawhide. [1] <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=543785">http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=543785</a>

Credit: secalert@redhat.com secalert@redhat.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/nvd-historical
• collector/nvd-index
• agent/type
• agent/remedy
• agent/first-publish-date
• collector/nvd-api
• source/NVD
• agent/software-canonical-lookup
• agent/author
• agent/severity
• agent/last-modified-date
• agent/references
• agent/weakness
• agent/softwarecombine
• agent/event
• agent/description
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2009-3611
• agent/tags
• collector/mitre-cve
• source/MITRE
• vendor/le-web
• canonical/le-web backintime
• version/le-web backintime/0.9.26
• vendor/fedoraproject
• canonical/fedoraproject fedora
• version/fedoraproject fedora/10
• version/fedoraproject fedora/11