CVE-2022-37705

A privilege escalation flaw was found in Amanda 3.5.1 in which the backup
user can acquire root privileges. The vulnerable component is the runtar
SUID program, which is a wrapper to run /usr/bin/tar with specific
arguments that are controllable by the attacker. This program mishandles
the arguments passed to tar binary (it expects that the argument name and
value are separated with a space; however, separating them with an equals
sign is also supported),

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1029829&gt;