CVE-2023-30577

Vulnerability

In AMANDA (Advanced Maryland Automatic Network Disk Archiver) versions before tag-community-3.5.4, the SUID binary runtar (located in client-src/runtar.c) improperly validates command-line arguments [2]. The binary can accept malicious GNU tar options when presented with a non-argument option starting with --exclude (such as --exclude-vcs). This allows an attacker to pass options like --use-compress-program that point to an attacker-controlled script, which runtar then executes with elevated privileges [2].

Exploitation

To exploit this vulnerability, an attacker must have access to the unprivileged backup user account [2]. The attacker crafts arguments to the SUID runtar binary, including a valid tar operation (e.g., tar --create) and a tar option that runtar incorrectly deems safe (e.g., --exclude-vcs) followed by --use-compress-program pointing to a script the attacker controls [2]. When runtar executes tar with these arguments, it runs the specified script with root privileges [2]. A publicly available proof of concept demonstrates this escalation [2].

Impact

The successful exploitation results in local privilege escalation [2]. The attacker, initially running as the unprivileged backup user, gains root-level command execution, allowing full compromise of the affected system [2].

Mitigation

The vulnerability is fixed in AMANDA release tag-community-3.5.4 [1][2]. Users should upgrade to this version or later. No workarounds are documented in the available references. For distributions like Fedora, package announcements may indicate the fixed version [3][4].