The cve-2022-37704 from maherazzouzi

cve-2022-37704's Introduction

[Suggested description] Amanda 3.5.1 has a flaw that allows privilege escalation from the regular user backup to root. The SUID binary located at /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which may lead to escalation of privileges, denial of service, and information disclosure.

[Additional Information] Amanda is a well known software and the package is present on all known Linux distributions and even on Windows. I think this bug is critical for that specific software, I may say this a trust vulnerability (the rundump binary trust /usr/sbin/dump) but unfortunately dump can be tampered with to have root shell. I will upload a PoC video when sending the e-mail!

[VulnerabilityType Other] External software flaw

[Vendor of Product] Amanda

[Affected Product Code Base] rundump - 3.5.1

[Affected Component] The affected component is rundump SUID binary from Amanda software. The affected C file is : rundump.c The affected line of code is : execve(dump_program, argv, env);

[Attack Type] Local

[Impact Denial of Service] true

[Impact Escalation of Privileges] true

[Impact Information Disclosure] true

[Attack Vectors] This vulnerability is an LPE to root. To exploit the flaw and become root the attacker should execute a bash script.

[Reference] http://www.amanda.org/

[Discoverer] Maher Azzouzi