Lucene search

RedhatCVE-2009-3611

HistoryOct 26, 2009 - 4:30 p.m.

CVE-2009-3611

2009-10-2616:30:00

CWE-732

redhat

web.nvd.nist.gov

cve-2009-3611

back in time

snapshot

permissions

sensitive information

backup integrity

CVSS2

3.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:P/A:N

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

6.5

Confidence

High

EPSS

Percentile

5.1%

JSON

common/snapshots.py in Back In Time (aka backintime) 0.9.26 changes certain permissions to 0777 before deleting the files in an old backup snapshot, which allows local users to obtain sensitive information by reading these files, or interfere with backup integrity by modifying files that are shared across snapshots.

Affected configurations

Nvd

Node

le-webbackintimeMatch0.9.26

Node

fedoraprojectfedoraMatch10

fedoraprojectfedoraMatch11

VendorProductVersionCPE
le-webbackintime0.9.26cpe:2.3:a:le-web:backintime:0.9.26:*:*:*:*:*:*:*
fedoraprojectfedora10cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:*
fedoraprojectfedora11cpe:2.3:o:fedoraproject:fedora:11:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
le-web	backintime	0.9.26	cpe:2.3:a:le-web:backintime:0.9.26:::::::*
fedoraproject	fedora	10	cpe:2.3:o:fedoraproject:fedora:10:::::::*
fedoraproject	fedora	11	cpe:2.3:o:fedoraproject:fedora:11:::::::*

References

bugs.debian.org/cgi-bin/bugreport.cgi?bug=543785

bugs.gentoo.org/show_bug.cgi?id=289047

ftp.debian.org/debian/pool/main/b/backintime/backintime_0.9.26-3.diff.gz

marc.info/?l=oss-security&m=125553645511436&w=2

marc.info/?l=oss-security&m=125554894700336&w=2

bugs.launchpad.net/ubuntu/+source/backintime/+bug/434256

bugzilla.redhat.com/show_bug.cgi?id=520210

www.redhat.com/archives/fedora-package-announce/2009-September/msg00821.html

www.redhat.com/archives/fedora-package-announce/2009-September/msg00823.html

CVSS2

3.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:P/A:N

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

6.5

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2009-3611