CVE-2022-37703

Name	CVE-2022-37703
Description	In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use `opendir()` as root directly without checking the path, letting the attacker provide an arbitrary path.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3681-1, DLA-3880-1
Debian Bugs	1021017

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
amanda (PTS)	bullseye	1:3.5.1-7	vulnerable
	bullseye (security)	1:3.5.1-7+deb11u1	fixed
	bookworm	1:3.5.1-11+deb12u2	fixed
	sid, trixie	1:3.5.4-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
amanda	source	buster	1:3.5.1-2+deb10u2	DLA-3681-1
amanda	source	bullseye	1:3.5.1-7+deb11u1	DLA-3880-1
amanda	source	(unstable)	1:3.5.1-10		1021017

Notes

https://github.com/MaherAzzouzi/CVE-2022-37703
https://github.com/zmanda/amanda/issues/192
https://github.com/zmanda/amanda/pull/198
https://github.com/zmanda/amanda/commit/b1dd708728fcab5e3a49ba5c0fb754776242efc3