CVE-2022-37704: Command Injection
Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which may lead to escalation of privileges, denial of service, and information disclosure.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-37704?
CVE-2022-37704 has a high severity rating due to its potential for privilege escalation.
How do I fix CVE-2022-37704?
To fix CVE-2022-37704, it is recommended to upgrade to a patched version of Amanda or remove the SUID bit from the rundump binary.
What impact can CVE-2022-37704 have on my system?
CVE-2022-37704 can lead to privilege escalation, which allows an attacker to gain root access and potentially compromise system security.
Which software versions are affected by CVE-2022-37704?
CVE-2022-37704 specifically affects Amanda version 3.5.1.
Can CVE-2022-37704 lead to information disclosure?
Yes, CVE-2022-37704 can potentially allow unauthorized information disclosure alongside privilege escalation.