CVE-2022-37704

Vulnerability

Amanda version 3.5.1 contains a privilege escalation vulnerability in the SUID binary rundump located at /lib/amanda/rundump. The binary executes /usr/sbin/dump as root using execve(dump_program, argv, env), passing attacker-controlled arguments. The dump program can be replaced or symlinked by an attacker. The affected component is rundump.c, and the flaw is present in the 3.5.1 release [2] [3].

Exploitation

An attacker must have local access as the backup user (or any user that can run the rundump binary). The attacker can replace or symlink /usr/sbin/dump with a malicious executable. Running rundump with crafted arguments will then execute the attacker's binary as root. No additional authentication or user interaction is required beyond being able to invoke the SUID binary [2].

Impact

Successful exploitation grants full root privileges to the attacker. This leads to a complete compromise of the system, including the ability to read, modify, or delete any file (information disclosure, denial of service), and to execute arbitrary code as the superuser [1] [2].

Mitigation

A fix was released in Amanda version 3.5.3 on March 15, 2023 [1]. Users should upgrade to 3.5.3 or later. If upgrading is not immediately possible, the rundump binary should have its SUID bit removed if the functionality is not required. No workaround is available for the vulnerability without applying the patch. The issue is not listed on CISA's Known Exploited Vulnerabilities Catalog as of this writing.