Bug 2126847 (CVE-2022-37703)

Summary:	CVE-2022-37703 amanda: information leak (discovery of directory existence)
Product:	[Other] Security Response	Reporter:	Sandipan Roy <saroy>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	fedora, jridky, j, pcahyna, phracek, rvokal
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	An information leak vulnerability was found in Amanda in the calcsize SUID binary. This flaw allows an attacker to know if a directory exists or not anywhere in the fs. The binary will use `opendir()` as root directly without checking the path, letting the attacker provide an arbitrary path.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2126848, 2126849
Bug Blocks:	2126837

Description Sandipan Roy 2022-09-14 14:30:53 UTC

In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use `opendir()` as root directly without checking the path, letting the attacker provide an arbitrary path.

http://www.amanda.org/
https://github.com/MaherAzzouzi/CVE-2022-37703

Comment 1 Sandipan Roy 2022-09-14 14:35:04 UTC

Created amanda tracking bugs for this issue:

Affects: fedora-all [bug 2126849]

Comment 3 Jason Tibbitts 2022-09-14 17:05:13 UTC

Note that the calcsize binary isn't executable by users in Fedora; the exploit would work only in the exceptional case that the user is in the "disk" group.

Comment 4 Mauro Matteo Cascella 2023-02-27 16:25:46 UTC

Upstream PR & commit:
https://github.com/zmanda/amanda/pull/198
https://github.com/zmanda/amanda/commit/b1dd708728fcab5e3a49ba5c0fb754776242efc3