Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found 2 articles for you...
197
security advisorysoftware updatedebianDebian 11: DLA-3880-1 Critical: Amanda Privilege Escalation Issues
Multiple vulnerabilities have been fixed in the Amanda backup system. CVE-2022-37703 . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3880-1
Sep 07, 2024
•Critical
Debian LTS
172
security advisorycriticalprivilege escalationUbuntu 23.10: USN-6614-1 Critical: Amanda Escalation Attack
amanda could be used to escalate privilege if it was provided with specially crafted arguments.. ========================================================================== Ubuntu Security Notice USN-6614-1 January 30, 2024 amanda vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 23.10 - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS (Available with Ubuntu Pro) Summary: amanda could be used to escalate privilege if it was provided with specially crafted arguments. Software Description: - amanda: Advanced Maryland Automatic Network Disk Archiver (Client) Details: It was discovered that amanda did not properly check certain arguments. A local unprivileged attacker could possibly use this issue to perform a privilege escalation attack. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 23.10: amanda-client 1:3.5.1-11ubuntu0.23.10.1 Ubuntu 22.04 LTS: amanda-client 1:3.5.1-8ubuntu1.4 Ubuntu 20.04 LTS: amanda-client 1:3.5.1-2ubuntu0.4 Ubuntu 18.04 LTS (Available with Ubuntu Pro): amanda-client 1:3.5.1-1ubuntu0.3+esm1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6614-1 CVE-2023-30577 Package Information: https://launchpad.net/ubuntu/+source/amanda/1:3.5.1-8ubuntu1.4 . A significant blueprint flaw enables privilege elevation across various Ubuntu versions. Detailed update guidance is provided.. Amanda Privilege Escalation, Ubuntu Update, Security Notice. . Severity: Critical. LinuxSecurity.com Team
Jan 30, 2024
•Critical
Ubuntu
197
security advisorysecurity updateinformation leakDebian 10: DLA-3681-1 moderate: amanda privilege escalation and info leak
Multiple vulnerabilties have been found in Amanda,a backup system designed to archive many computers on a network to a single large-capacity tape drive. The vulnerabilties potentially allows local privilege escalation from the backup user to root or leak information . ------------------------------------------------------------------------- Debian LTS Advisory DLA-3681-1
Dec 03, 2023
Debian LTS
89
security advisorymoderatesecurity issueFedora 38: FEDORA-2023-4db1d56125 Moderate: Amanda Security Issue Fix
Update to new upstream version 3.5.4. This brings a fix for a security issue, CVE-2023-30577. This update also fixes the manual pages.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2023-4db1d56125 2023-08-05 01:37:28.394289 -------------------------------------------------------------------------------- Name : amanda Product : Fedora 38 Version : 3.5.4 Release : 3.fc38 URL : https://www.amanda.org/ Summary : A network-capable tape backup solution Description : AMANDA, the Advanced Maryland Automatic Network Disk Archiver, is a backup system that allows the administrator of a LAN to set up a single master backup server to back up multiple hosts to one or more tape drives or disk files. AMANDA uses native dump and/or GNU tar facilities and can back up a large number of workstations running multiple versions of Unix. Newer versions of AMANDA (including this version) can use SAMBA to back up Microsoft(TM) Windows95/NT hosts. The amanda package contains the core AMANDA programs and will need to be installed on both AMANDA clients and AMANDA servers. Note that you will have to install the amanda-client and/or amanda-server packages as well. -------------------------------------------------------------------------------- Update Information: Update to new upstream version 3.5.4. This brings a fix for a security issue, CVE-2023-30577. This update also fixes the manual pages. -------------------------------------------------------------------------------- ChangeLog: * Thu Jul 27 2023 Jason Tibbitts - 3.5.4-3 - Add sources. * Thu Jul 27 2023 Jason Tibbitts - 3.5.4-2 - Fix build of manpages * Thu Jul 27 2023 Jason Tibbitts - 3.5.4-1 - Update to 3.5.4 * Wed Jul 19 2023 Fedora Release Engineering - 3.5.3-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild * Tue Jul 11 2023 Jitka Plesnikova - 3.5.3-4 - Perl 5.38 rebuild * Tue May 2 2023 JosefRidky - 3.5.3-3 - move to SPDX license format * Fri Apr 14 2023 Florian Weimer - 3.5.3-2 - Port configure script to C99 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2208319 - Amanda was built without man pages https://bugzilla.redhat.com/show_bug.cgi?id=2208319 [ 2 ] Bug #2226890 - TRIAGE-CVE-2023-30577 amanda: Improper argument checking for runtar.c [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2226890 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-4db1d56125' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Aug 05, 2023
Fedora
89
security advisorysecurity issueupdateFedora 37: 2023-566e354e4a Moderate: amanda Argument Checking Issue
Update to new upstream version 3.5.4. This brings a fix for a security issue, CVE-2023-30577. This update also fixes the manual pages.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2023-566e354e4a 2023-08-05 01:18:36.275568 -------------------------------------------------------------------------------- Name : amanda Product : Fedora 37 Version : 3.5.4 Release : 3.fc37 URL : https://www.amanda.org/ Summary : A network-capable tape backup solution Description : AMANDA, the Advanced Maryland Automatic Network Disk Archiver, is a backup system that allows the administrator of a LAN to set up a single master backup server to back up multiple hosts to one or more tape drives or disk files. AMANDA uses native dump and/or GNU tar facilities and can back up a large number of workstations running multiple versions of Unix. Newer versions of AMANDA (including this version) can use SAMBA to back up Microsoft(TM) Windows95/NT hosts. The amanda package contains the core AMANDA programs and will need to be installed on both AMANDA clients and AMANDA servers. Note that you will have to install the amanda-client and/or amanda-server packages as well. -------------------------------------------------------------------------------- Update Information: Update to new upstream version 3.5.4. This brings a fix for a security issue, CVE-2023-30577. This update also fixes the manual pages. -------------------------------------------------------------------------------- ChangeLog: * Thu Jul 27 2023 Jason Tibbitts - 3.5.4-3 - Add sources. * Thu Jul 27 2023 Jason Tibbitts - 3.5.4-2 - Fix build of manpages * Thu Jul 27 2023 Jason Tibbitts - 3.5.4-1 - Update to 3.5.4 * Wed Jul 19 2023 Fedora Release Engineering - 3.5.3-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild * Tue Jul 11 2023 Jitka Plesnikova - 3.5.3-4 - Perl 5.38 rebuild * Tue May 2 2023 JosefRidky - 3.5.3-3 - move to SPDX license format * Fri Apr 14 2023 Florian Weimer - 3.5.3-2 - Port configure script to C99 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2208319 - Amanda was built without man pages https://bugzilla.redhat.com/show_bug.cgi?id=2208319 [ 2 ] Bug #2226890 - TRIAGE-CVE-2023-30577 amanda: Improper argument checking for runtar.c [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2226890 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-566e354e4a' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Aug 05, 2023
Fedora
172
security advisoryprivilege escalationsecurity fixUbuntu 22.10 USN-5966-3 Moderate: Amanda Security Updates
Several security issues were fixed in amanda.. =========================================================================Ubuntu Security Notice USN-5966-3 April 03, 2023 amanda regression ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.10 - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: Several security issues were fixed in amanda. Software Description: - amanda: Advanced Maryland Automatic Network Disk Archiver (Client) Details: USN-5966-1 fixed vulnerabilities in amanda. Unfortunately that update caused a regression and was reverted in USN-5966-2. This update provides security fixes for Ubuntu 22.10, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS and Ubuntu 18.04 LTS. We apologize for the inconvenience. Original advisory details: Maher Azzouzi discovered an information disclosure vulnerability in the calcsize binary within amanda. calcsize is a suid binary owned by root that could possibly be used by a malicious local attacker to expose sensitive file system information. (CVE-2022-37703) Maher Azzouzi discovered a privilege escalation vulnerability in the rundump binary within amanda. rundump is a suid binary owned by root that did not perform adequate sanitization of environment variables or commandline options and could possibly be used by a malicious local attacker to escalate privileges. (CVE-2022-37704) Maher Azzouzi discovered a privilege escalation vulnerability in the runtar binary within amanda. runtar is a suid binary owned by root that did not perform adequate sanitization of commandline options and could possibly be used by a malicious local attacker to escalate privileges. (CVE-2022-37705) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.10: amanda-client 1:3.5.1-9ubuntu0.3 Ubuntu 22.04 LTS: amanda-client 1:3.5.1-8ubuntu1.3 Ubuntu 20.04LTS: amanda-client 1:3.5.1-2ubuntu0.3 Ubuntu 18.04 LTS: amanda-client 1:3.5.1-1ubuntu0.3 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-5966-3 https://ubuntu.com/security/notices/USN-5966-1 https://bugs.launchpad.net/ubuntu/+source/amanda/+bug/2012536 CVE-2022-37703, CVE-2022-37704, CVE-2022-37705 Package Information: https://launchpad.net/ubuntu/+source/amanda/1:3.5.1-9ubuntu0.3 https://launchpad.net/ubuntu/+source/amanda/1:3.5.1-8ubuntu1.3 https://launchpad.net/ubuntu/+source/amanda/1:3.5.1-2ubuntu0.3 https://launchpad.net/ubuntu/+source/amanda/1:3.5.1-1ubuntu0.3 . Numerous patches have been applied to amanda across different Ubuntu iterations resolving critical vulnerabilities detected within the application.. amanda security, Ubuntu security updates, privilege escalation, information disclosure. . Severity: Important. LinuxSecurity.com Team
Apr 03, 2023
•Important
Ubuntu
89
security advisoryfedoralocal privilege escalationFedora 37 Advisory: Update to Amanda 3.5.3 For Minor Security Threats
Update to version 3.5.3, which contains fixes for three minor security issues as well as other minor bugfixes. https://github.com/zmanda/amanda/releases/tag/tag-community-3.5.3. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2023-e295804b3d 2023-04-02 02:00:15.070719 --------------------------------------------------------------------------------Name : amanda Product : Fedora 37 Version : 3.5.3 Release : 1.fc37 URL : https://www.amanda.org/ Summary : A network-capable tape backup solution Description : AMANDA, the Advanced Maryland Automatic Network Disk Archiver, is a backup system that allows the administrator of a LAN to set up a single master backup server to back up multiple hosts to one or more tape drives or disk files. AMANDA uses native dump and/or GNU tar facilities and can back up a large number of workstations running multiple versions of Unix. Newer versions of AMANDA (including this version) can use SAMBA to back up Microsoft(TM) Windows95/NT hosts. The amanda package contains the core AMANDA programs and will need to be installed on both AMANDA clients and AMANDA servers. Note that you will have to install the amanda-client and/or amanda-server packages as well. --------------------------------------------------------------------------------Update Information: Update to version 3.5.3, which contains fixes for three minor security issues as well as other minor bugfixes. https://github.com/zmanda/amanda/releases/tag/tag-community-3.5.3 --------------------------------------------------------------------------------ChangeLog: * Thu Mar 16 2023 Orion Poplawski - 3.5.3-1 - Update to 3.5.3 - Fixes CVE-2022-37703 (bz#2126849) CVE-2022-37704 (bz#2168789) CVE-2022-37705 (bz#2168797) * Wed Jan 18 2023 Fedora Release Engineering - 3.5.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild * Tue Aug 30 2022 Orion Poplawski - 3.5.2-1 - Update to3.5.2 --------------------------------------------------------------------------------References: [ 1 ] Bug #2104645 - amanda bugfix for build/test issue and missing 1st char in error message https://bugzilla.redhat.com/show_bug.cgi?id=2104645 [ 2 ] Bug #2126849 - CVE-2022-37703 amanda: information leak (discovery of directory existence) [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2126849 [ 3 ] Bug #2168789 - CVE-2022-37704 amanda: rundump: local privilege escalation [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2168789 [ 4 ] Bug #2168797 - CVE-2022-37705 amanda: crafted arguments to the runtar SUID binary leads to local privilege escalation to root [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2168797 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-e295804b3d' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Apr 02, 2023
•Important
Fedora
89
security advisorymoderateupdateFedora 36: FEDORA-2023-1293196f34 Moderate Amanda Update
Update to version 3.5.3, which contains fixes for three minor security issues as well as other minor bugfixes. https://github.com/zmanda/amanda/releases/tag/tag-community-3.5.3. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2023-1293196f34 2023-04-02 01:33:23.803433 --------------------------------------------------------------------------------Name : amanda Product : Fedora 36 Version : 3.5.3 Release : 1.fc36 URL : https://www.amanda.org/ Summary : A network-capable tape backup solution Description : AMANDA, the Advanced Maryland Automatic Network Disk Archiver, is a backup system that allows the administrator of a LAN to set up a single master backup server to back up multiple hosts to one or more tape drives or disk files. AMANDA uses native dump and/or GNU tar facilities and can back up a large number of workstations running multiple versions of Unix. Newer versions of AMANDA (including this version) can use SAMBA to back up Microsoft(TM) Windows95/NT hosts. The amanda package contains the core AMANDA programs and will need to be installed on both AMANDA clients and AMANDA servers. Note that you will have to install the amanda-client and/or amanda-server packages as well. --------------------------------------------------------------------------------Update Information: Update to version 3.5.3, which contains fixes for three minor security issues as well as other minor bugfixes. https://github.com/zmanda/amanda/releases/tag/tag-community-3.5.3 --------------------------------------------------------------------------------ChangeLog: * Thu Mar 16 2023 Orion Poplawski - 3.5.3-1 - Update to 3.5.3 - Fixes CVE-2022-37703 (bz#2126849) CVE-2022-37704 (bz#2168789) CVE-2022-37705 (bz#2168797) * Wed Jan 18 2023 Fedora Release Engineering - 3.5.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild * Tue Aug 30 2022 Orion Poplawski - 3.5.2-1 - Update to3.5.2 * Wed Jul 20 2022 Fedora Release Engineering - 3.5.1-37 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild --------------------------------------------------------------------------------References: [ 1 ] Bug #2104645 - amanda bugfix for build/test issue and missing 1st char in error message https://bugzilla.redhat.com/show_bug.cgi?id=2104645 [ 2 ] Bug #2126849 - CVE-2022-37703 amanda: information leak (discovery of directory existence) [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2126849 [ 3 ] Bug #2168789 - CVE-2022-37704 amanda: rundump: local privilege escalation [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2168789 [ 4 ] Bug #2168797 - CVE-2022-37705 amanda: crafted arguments to the runtar SUID binary leads to local privilege escalation to root [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2168797 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-1293196f34' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Apr 02, 2023
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!