CVE-2016-10729

NameCVE-2016-10729
DescriptionAn issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client installation. The "runtar" setuid root binary does not check for additional arguments supplied after --create, allowing users to manipulate commands and perform command injection as root.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
amanda (PTS)jessie1:3.3.6-4vulnerable
stretch (lts), stretch1:3.3.9-5+deb9u2fixed
buster1:3.5.1-2fixed
buster (security)1:3.5.1-2+deb10u2fixed
bullseye1:3.5.1-7fixed
bookworm1:3.5.1-11+deb12u1fixed
sid, trixie1:3.5.1-11.1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
amandasource(unstable)1:3.3.9-1unimportant

Notes

https://www.exploit-db.com/exploits/39217/
/usr/lib/amanda/runtar can only be run by members of the backup
group (which is root-equivalent due to being able to perform restores e.g.)

Search for package or bug name: Reporting problems