USN-843-1: BackupPC vulnerability

It was discovered that BackupPC did not restrict normal users from setting the ClientNameAlias parameter. An authenticated user could exploit this to gain access to unauthorized hosts. This update fixed the issue by preventing normal users from modifying the ClientNameAlias configuration paramete...

Mandrake Security Advisory MDVSA-2009:253 (backuppc)

The remote host is missing an update to backuppc announced via advisory MDVSA-2009:253. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

Mandrake Security Advisory MDVSA-2009:253 (backuppc)

The remote host is missing an update to backuppc announced via advisory MDVSA-2009:253. OpenVAS Vulnerability Test $Id: mdksa2009253.nasl 6587 2017-07-07 06:35:35Z cfischer $ Description: Auto-generated from advisory MDVSA-2009:253 backuppc Authors: Thomas Reinke Copyright: Copyright c 2009 E-Sof...

[ MDVSA-2009:253 ] backuppc

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2009:253 http://www.mandriva.com/security/ Package : backuppc Date : October 1, 2009 Affected: Enterprise Server 5.0 Problem Description: A vulnerability was discovered and corrected in backuppc: CgiUserConfigEdi...

BackupPC privilege escalation

Privilege escalation with CgiUserConfigEdit...

CVE-2009-3369

CgiUserConfigEdit in BackupPC 3.1.0, when SSH keys and Rsync are in use in a multi-user environment, does not restrict users from the ClientNameAlias function, which allows remote authenticated users to read and write sensitive files by modifying ClientNameAlias to match another system, then...

CVE-2009-3369

CgiUserConfigEdit in BackupPC 3.1.0, when SSH keys and Rsync are in use in a multi-user environment, does not restrict users from the ClientNameAlias function, which allows remote authenticated users to read and write sensitive files by modifying ClientNameAlias to match another system, then...

Design/Logic Flaw

CgiUserConfigEdit in BackupPC 3.1.0, when SSH keys and Rsync are in use in a multi-user environment, does not restrict users from the ClientNameAlias function, which allows remote authenticated users to read and write sensitive files by modifying ClientNameAlias to match another system, then...

CVE-2009-3369

CgiUserConfigEdit in BackupPC 3.1.0, when SSH keys and Rsync are in use in a multi-user environment, does not restrict users from the ClientNameAlias function, which allows remote authenticated users to read and write sensitive files by modifying ClientNameAlias to match another system, then...

CVE-2009-3369

CgiUserConfigEdit in BackupPC 3.1.0, when SSH keys and Rsync are in use in a multi-user environment, does not restrict users from the ClientNameAlias function, which allows remote authenticated users to read and write sensitive files by modifying ClientNameAlias to match another system, then...

CVE-2009-3369

CVE-2009-3369 affects BackupPC 3.1.0 where CgiUserConfigEdit does not restrict ClientNameAlias in multi-user setups using SSH keys and Rsync, allowing remote authenticated users to read/write sensitive files by aliasing to another system during backup/restore. The issue is due to insufficient res...

CVE-2009-3369

CgiUserConfigEdit in BackupPC 3.1.0, when SSH keys and Rsync are in use in a multi-user environment, does not restrict users from the ClientNameAlias function, which allows remote authenticated users to read and write sensitive files by modifying ClientNameAlias to match another system, then...

PT-2009-5676

Name of the Vulnerable Software and Affected Versions: BackupPC version 3.1.0 Description: The issue allows remote authenticated users to read and write sensitive files by modifying the ClientNameAlias function to match another system and then initiating a backup or restore. This is possible when...

CVE-2009-3369: Undefined Security Weakness

CgiUserConfigEdit in BackupPC 3.1.0, when SSH keys and Rsync are in use in a multi-user environment, does not restrict users from the ClientNameAlias function, which allows remote authenticated users to read and write sensitive files by modifying ClientNameAlias to match another system, then...