CVE-2016-10729

NameCVE-2016-10729
DescriptionAn issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client installation. The "runtar" setuid root binary does not check for additional arguments supplied after --create, allowing users to manipulate commands and perform command injection as root.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
amanda (PTS)jessie1:3.3.6-4vulnerable
stretch1:3.3.9-5vulnerable
buster, sid1:3.5.1-2vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
amandasource(unstable)(unfixed)unimportant

Notes

https://www.exploit-db.com/exploits/39217/
/usr/lib/amanda/runtar can only be run by members of the backup
group (which is root-equivalent due to being able to perform restores e.g.)

Search for package or bug name: Reporting problems