CVE-2022-37704

Summary of CVE-2022-37704 : Amanda 3.5.1 contains a privilege escalation in the SUID binary /lib/amanda/rundump, which can cause root execution of /usr/sbin/dump with attacker-controlled arguments. This can enable local privilege escalation, and may also lead to denial of service and information ...

CVE-2023-30577

AMANDA (backup system) is affected by CVE-2023-30577: the SUID binary runtar mishandles arguments, allowing certain GNU tar options (e.g., starting with --exclude) to be accepted and potentially cause root-level execution. This is a local privilege-escalation path tied to runtar’s argument handli...

CVE-2022-37705

CVE-2022-37705 affects Amanda 3.5.1. The runtar SUID wrapper to tar mishandles arguments, enabling a backup user to escalate to root. Public notes in Debian LTS advisories confirm a fix in amanda packages (e.g., Debian 11 1:3.5.1-7+deb11u1) and CloudLinux/LT advisory references indicate tar optio...

CVE-2016-10729

CVE-2016-10729 concerns Amanda 3.3.1 where the runtar setuid root binary does not validate extra arguments after --create, enabling a local attacker with backup privileges to perform command injection as root. The vulnerability is a local privilege escalation with potential full compromise of a c...

CVE-2016-10730

CVE-2016-10730 affects Amanda 3.3.1. The Amstar component can be invoked in a way that leads to privilege escalation via the --star-path handling, with runtar and other components running setuid/root—allowing a backup-privileged user to compromise a client installation (local, root-level impact)....

CVE-2019-19469

CVE-2019-19469 affects Zmanda Management Console (ZMC) 3.3.9. The vulnerability is a CSRF flaw in ZMC_Admin_Advanced?form=adminTasks&action=Apply&command= that can enable command injection via shell metacharacters, with potential reliance on weak default credentials. Exploitation is demonstrated/...