CVE-2009-3369

2009-09-2400:00:00

ubuntu.com

8.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:C/I:C/A:C

0.004 Low

EPSS

Percentile

72.7%

JSON

CgiUserConfigEdit in BackupPC 3.1.0, when SSH keys and Rsync are in use in
a multi-user environment, does not restrict users from the ClientNameAlias
function, which allows remote authenticated users to read and write
sensitive files by modifying ClientNameAlias to match another system, then
initiating a backup or restore.

Bugs

<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=542218>

Notes

Author	Note
mdeslaur	debian patch is incomplete, see debian bug report

OSVersionArchitecturePackageVersionFilename
ubuntu8.04noarchbackuppc< 3.0.0-4ubuntu1.1UNKNOWN
ubuntu8.10noarchbackuppc< 3.1.0-3ubuntu2.1UNKNOWN
ubuntu9.04noarchbackuppc< 3.1.0-4ubuntu1.1UNKNOWN