All the vulnerabilites related to storebackup - storebackup
cve-2005-3148
Vulnerability from cvelistv5
Published
2005-10-05 04:00
Modified
2024-08-07 23:01
Severity ?
Summary
StoreBackup before 1.19 does not properly set the uid and guid for symbolic links (1) that are backed up by storeBackup.pl, or (2) recovered by storeBackupRecover.pl, which could cause files to be restored with incorrect ownership.
References
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332434x_refsource_MISC
http://www.us.debian.org/security/2006/dsa-1022vendor-advisory, x_refsource_DEBIAN
http://sourceforge.net/project/shownotes.php?release_id=352676x_refsource_CONFIRM
http://secunia.com/advisories/19489third-party-advisory, x_refsource_SECUNIA
http://secunia.com/advisories/17025third-party-advisory, x_refsource_SECUNIA
http://www.securityfocus.com/advisories/9384vendor-advisory, x_refsource_SUSE
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T23:01:57.891Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332434"
          },
          {
            "name": "DSA-1022",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.us.debian.org/security/2006/dsa-1022"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://sourceforge.net/project/shownotes.php?release_id=352676"
          },
          {
            "name": "19489",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/19489"
          },
          {
            "name": "17025",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/17025"
          },
          {
            "name": "SUSE-SR:2005:021",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/advisories/9384"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2005-09-30T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "StoreBackup before 1.19 does not properly set the uid and guid for symbolic links (1) that are backed up by storeBackup.pl, or (2) recovered by storeBackupRecover.pl, which could cause files to be restored with incorrect ownership."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2006-01-17T10:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332434"
        },
        {
          "name": "DSA-1022",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.us.debian.org/security/2006/dsa-1022"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://sourceforge.net/project/shownotes.php?release_id=352676"
        },
        {
          "name": "19489",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/19489"
        },
        {
          "name": "17025",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/17025"
        },
        {
          "name": "SUSE-SR:2005:021",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://www.securityfocus.com/advisories/9384"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2005-3148",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "StoreBackup before 1.19 does not properly set the uid and guid for symbolic links (1) that are backed up by storeBackup.pl, or (2) recovered by storeBackupRecover.pl, which could cause files to be restored with incorrect ownership."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332434",
              "refsource": "MISC",
              "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332434"
            },
            {
              "name": "DSA-1022",
              "refsource": "DEBIAN",
              "url": "http://www.us.debian.org/security/2006/dsa-1022"
            },
            {
              "name": "http://sourceforge.net/project/shownotes.php?release_id=352676",
              "refsource": "CONFIRM",
              "url": "http://sourceforge.net/project/shownotes.php?release_id=352676"
            },
            {
              "name": "19489",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/19489"
            },
            {
              "name": "17025",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/17025"
            },
            {
              "name": "SUSE-SR:2005:021",
              "refsource": "SUSE",
              "url": "http://www.securityfocus.com/advisories/9384"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2005-3148",
    "datePublished": "2005-10-05T04:00:00",
    "dateReserved": "2005-10-05T00:00:00",
    "dateUpdated": "2024-08-07T23:01:57.891Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2005-3146
Vulnerability from cvelistv5
Published
2005-10-05 04:00
Modified
2024-08-07 23:01
Severity ?
Summary
StoreBackup before 1.19 allows local users to perform unauthorized operations on arbitrary files via a symlink attack on temporary files.
References
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332434x_refsource_MISC
http://www.us.debian.org/security/2006/dsa-1022vendor-advisory, x_refsource_DEBIAN
http://sourceforge.net/project/shownotes.php?release_id=352676x_refsource_CONFIRM
http://secunia.com/advisories/19489third-party-advisory, x_refsource_SECUNIA
http://www.securityfocus.com/bid/14985vdb-entry, x_refsource_BID
http://secunia.com/advisories/17025third-party-advisory, x_refsource_SECUNIA
http://www.securityfocus.com/advisories/9384vendor-advisory, x_refsource_SUSE
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T23:01:57.698Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332434"
          },
          {
            "name": "DSA-1022",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.us.debian.org/security/2006/dsa-1022"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://sourceforge.net/project/shownotes.php?release_id=352676"
          },
          {
            "name": "19489",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/19489"
          },
          {
            "name": "14985",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/14985"
          },
          {
            "name": "17025",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/17025"
          },
          {
            "name": "SUSE-SR:2005:021",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/advisories/9384"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2005-09-30T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "StoreBackup before 1.19 allows local users to perform unauthorized operations on arbitrary files via a symlink attack on temporary files."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2006-01-17T10:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332434"
        },
        {
          "name": "DSA-1022",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.us.debian.org/security/2006/dsa-1022"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://sourceforge.net/project/shownotes.php?release_id=352676"
        },
        {
          "name": "19489",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/19489"
        },
        {
          "name": "14985",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/14985"
        },
        {
          "name": "17025",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/17025"
        },
        {
          "name": "SUSE-SR:2005:021",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://www.securityfocus.com/advisories/9384"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2005-3146",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "StoreBackup before 1.19 allows local users to perform unauthorized operations on arbitrary files via a symlink attack on temporary files."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332434",
              "refsource": "MISC",
              "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332434"
            },
            {
              "name": "DSA-1022",
              "refsource": "DEBIAN",
              "url": "http://www.us.debian.org/security/2006/dsa-1022"
            },
            {
              "name": "http://sourceforge.net/project/shownotes.php?release_id=352676",
              "refsource": "CONFIRM",
              "url": "http://sourceforge.net/project/shownotes.php?release_id=352676"
            },
            {
              "name": "19489",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/19489"
            },
            {
              "name": "14985",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/14985"
            },
            {
              "name": "17025",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/17025"
            },
            {
              "name": "SUSE-SR:2005:021",
              "refsource": "SUSE",
              "url": "http://www.securityfocus.com/advisories/9384"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2005-3146",
    "datePublished": "2005-10-05T04:00:00",
    "dateReserved": "2005-10-05T00:00:00",
    "dateUpdated": "2024-08-07T23:01:57.698Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2005-3147
Vulnerability from cvelistv5
Published
2005-10-05 04:00
Modified
2024-08-07 23:01
Severity ?
Summary
StoreBackup before 1.19 creates the backup root with world-readable permissions, which allows local users to obtain sensitive information.
References
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332434x_refsource_MISC
http://www.us.debian.org/security/2006/dsa-1022vendor-advisory, x_refsource_DEBIAN
http://sourceforge.net/project/shownotes.php?release_id=352676x_refsource_CONFIRM
http://secunia.com/advisories/19489third-party-advisory, x_refsource_SECUNIA
http://secunia.com/advisories/17025third-party-advisory, x_refsource_SECUNIA
http://www.securityfocus.com/advisories/9384vendor-advisory, x_refsource_SUSE
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T23:01:57.914Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332434"
          },
          {
            "name": "DSA-1022",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.us.debian.org/security/2006/dsa-1022"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://sourceforge.net/project/shownotes.php?release_id=352676"
          },
          {
            "name": "19489",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/19489"
          },
          {
            "name": "17025",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/17025"
          },
          {
            "name": "SUSE-SR:2005:021",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/advisories/9384"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2005-09-30T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "StoreBackup before 1.19 creates the backup root with world-readable permissions, which allows local users to obtain sensitive information."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2006-01-17T10:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332434"
        },
        {
          "name": "DSA-1022",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.us.debian.org/security/2006/dsa-1022"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://sourceforge.net/project/shownotes.php?release_id=352676"
        },
        {
          "name": "19489",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/19489"
        },
        {
          "name": "17025",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/17025"
        },
        {
          "name": "SUSE-SR:2005:021",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://www.securityfocus.com/advisories/9384"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2005-3147",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "StoreBackup before 1.19 creates the backup root with world-readable permissions, which allows local users to obtain sensitive information."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332434",
              "refsource": "MISC",
              "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332434"
            },
            {
              "name": "DSA-1022",
              "refsource": "DEBIAN",
              "url": "http://www.us.debian.org/security/2006/dsa-1022"
            },
            {
              "name": "http://sourceforge.net/project/shownotes.php?release_id=352676",
              "refsource": "CONFIRM",
              "url": "http://sourceforge.net/project/shownotes.php?release_id=352676"
            },
            {
              "name": "19489",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/19489"
            },
            {
              "name": "17025",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/17025"
            },
            {
              "name": "SUSE-SR:2005:021",
              "refsource": "SUSE",
              "url": "http://www.securityfocus.com/advisories/9384"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2005-3147",
    "datePublished": "2005-10-05T04:00:00",
    "dateReserved": "2005-10-05T00:00:00",
    "dateUpdated": "2024-08-07T23:01:57.914Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2020-7040
Vulnerability from cvelistv5
Published
2020-01-21 20:03
Modified
2024-08-04 09:18
Severity ?
Summary
storeBackup.pl in storeBackup through 3.5 relies on the /tmp/storeBackup.lock pathname, which allows symlink attacks that possibly lead to privilege escalation. (Local users can also create a plain file named /tmp/storeBackup.lock to block use of storeBackup until an admin manually deletes that file.)
References
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2020-7040x_refsource_MISC
http://www.openwall.com/lists/oss-security/2020/01/20/3x_refsource_MISC
https://seclists.org/oss-sec/2020/q1/20mailing-list, x_refsource_MLIST
http://www.openwall.com/lists/oss-security/2020/01/21/2mailing-list, x_refsource_MLIST
http://www.openwall.com/lists/oss-security/2020/01/22/2mailing-list, x_refsource_MLIST
http://www.openwall.com/lists/oss-security/2020/01/22/3mailing-list, x_refsource_MLIST
http://www.openwall.com/lists/oss-security/2020/01/23/1mailing-list, x_refsource_MLIST
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00054.htmlvendor-advisory, x_refsource_SUSE
https://lists.debian.org/debian-lts-announce/2020/02/msg00003.htmlmailing-list, x_refsource_MLIST
https://usn.ubuntu.com/4508-1/vendor-advisory, x_refsource_UBUNTU
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T09:18:02.843Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2020-7040"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2020/01/20/3"
          },
          {
            "name": "[oss-security]  CVE-2020-7040: storeBackup: denial of service and symlink attack vector via fixed lockfile path /tmp/storeBackup.lock",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://seclists.org/oss-sec/2020/q1/20"
          },
          {
            "name": "[oss-security] 20200121 Re: CVE-2020-7040: storeBackup: denial of service and symlink attack vector via fixed lockfile path /tmp/storeBackup.lock",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2020/01/21/2"
          },
          {
            "name": "[oss-security] 20200122 Re: CVE-2020-7040: storeBackup: denial of service and symlink attack vector via fixed lockfile path /tmp/storeBackup.lock",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2020/01/22/2"
          },
          {
            "name": "[oss-security] 20200122 Re: CVE-2020-7040: storeBackup: denial of service and symlink attack vector via fixed lockfile path /tmp/storeBackup.lock",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2020/01/22/3"
          },
          {
            "name": "[oss-security] 20200123 Re: CVE-2020-7040: storeBackup: denial of service and symlink attack vector via fixed lockfile path /tmp/storeBackup.lock",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2020/01/23/1"
          },
          {
            "name": "openSUSE-SU-2020:0119",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00054.html"
          },
          {
            "name": "[debian-lts-announce] 20200205 [SECURITY] [DLA 2095-1] storebackup security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00003.html"
          },
          {
            "name": "USN-4508-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4508-1/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "storeBackup.pl in storeBackup through 3.5 relies on the /tmp/storeBackup.lock pathname, which allows symlink attacks that possibly lead to privilege escalation. (Local users can also create a plain file named /tmp/storeBackup.lock to block use of storeBackup until an admin manually deletes that file.)"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-09-17T22:06:13",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2020-7040"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2020/01/20/3"
        },
        {
          "name": "[oss-security]  CVE-2020-7040: storeBackup: denial of service and symlink attack vector via fixed lockfile path /tmp/storeBackup.lock",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://seclists.org/oss-sec/2020/q1/20"
        },
        {
          "name": "[oss-security] 20200121 Re: CVE-2020-7040: storeBackup: denial of service and symlink attack vector via fixed lockfile path /tmp/storeBackup.lock",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2020/01/21/2"
        },
        {
          "name": "[oss-security] 20200122 Re: CVE-2020-7040: storeBackup: denial of service and symlink attack vector via fixed lockfile path /tmp/storeBackup.lock",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2020/01/22/2"
        },
        {
          "name": "[oss-security] 20200122 Re: CVE-2020-7040: storeBackup: denial of service and symlink attack vector via fixed lockfile path /tmp/storeBackup.lock",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2020/01/22/3"
        },
        {
          "name": "[oss-security] 20200123 Re: CVE-2020-7040: storeBackup: denial of service and symlink attack vector via fixed lockfile path /tmp/storeBackup.lock",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2020/01/23/1"
        },
        {
          "name": "openSUSE-SU-2020:0119",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00054.html"
        },
        {
          "name": "[debian-lts-announce] 20200205 [SECURITY] [DLA 2095-1] storebackup security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00003.html"
        },
        {
          "name": "USN-4508-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4508-1/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-7040",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "storeBackup.pl in storeBackup through 3.5 relies on the /tmp/storeBackup.lock pathname, which allows symlink attacks that possibly lead to privilege escalation. (Local users can also create a plain file named /tmp/storeBackup.lock to block use of storeBackup until an admin manually deletes that file.)"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2020-7040",
              "refsource": "MISC",
              "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2020-7040"
            },
            {
              "name": "http://www.openwall.com/lists/oss-security/2020/01/20/3",
              "refsource": "MISC",
              "url": "http://www.openwall.com/lists/oss-security/2020/01/20/3"
            },
            {
              "name": "[oss-security]  CVE-2020-7040: storeBackup: denial of service and symlink attack vector via fixed lockfile path /tmp/storeBackup.lock",
              "refsource": "MLIST",
              "url": "https://seclists.org/oss-sec/2020/q1/20"
            },
            {
              "name": "[oss-security] 20200121 Re: CVE-2020-7040: storeBackup: denial of service and symlink attack vector via fixed lockfile path /tmp/storeBackup.lock",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2020/01/21/2"
            },
            {
              "name": "[oss-security] 20200122 Re: CVE-2020-7040: storeBackup: denial of service and symlink attack vector via fixed lockfile path /tmp/storeBackup.lock",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2020/01/22/2"
            },
            {
              "name": "[oss-security] 20200122 Re: CVE-2020-7040: storeBackup: denial of service and symlink attack vector via fixed lockfile path /tmp/storeBackup.lock",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2020/01/22/3"
            },
            {
              "name": "[oss-security] 20200123 Re: CVE-2020-7040: storeBackup: denial of service and symlink attack vector via fixed lockfile path /tmp/storeBackup.lock",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2020/01/23/1"
            },
            {
              "name": "openSUSE-SU-2020:0119",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00054.html"
            },
            {
              "name": "[debian-lts-announce] 20200205 [SECURITY] [DLA 2095-1] storebackup security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00003.html"
            },
            {
              "name": "USN-4508-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4508-1/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-7040",
    "datePublished": "2020-01-21T20:03:11",
    "dateReserved": "2020-01-14T00:00:00",
    "dateUpdated": "2024-08-04T09:18:02.843Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Vulnerability from fkie_nvd
Published
2020-01-21 21:15
Modified
2024-11-21 05:36
Severity ?
8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
storeBackup.pl in storeBackup through 3.5 relies on the /tmp/storeBackup.lock pathname, which allows symlink attacks that possibly lead to privilege escalation. (Local users can also create a plain file named /tmp/storeBackup.lock to block use of storeBackup until an admin manually deletes that file.)
References
cve@mitre.orghttp://lists.opensuse.org/opensuse-security-announce/2020-01/msg00054.htmlMailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2020/01/20/3Mailing List, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2020/01/21/2Mailing List, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2020/01/22/2Mailing List, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2020/01/22/3Mailing List, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2020/01/23/1Mailing List, Third Party Advisory
cve@mitre.orghttps://bugzilla.suse.com/show_bug.cgi?id=CVE-2020-7040Issue Tracking, Third Party Advisory
cve@mitre.orghttps://lists.debian.org/debian-lts-announce/2020/02/msg00003.htmlMailing List, Third Party Advisory
cve@mitre.orghttps://seclists.org/oss-sec/2020/q1/20Mailing List, Third Party Advisory
cve@mitre.orghttps://usn.ubuntu.com/4508-1/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00054.htmlMailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2020/01/20/3Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2020/01/21/2Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2020/01/22/2Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2020/01/22/3Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2020/01/23/1Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.suse.com/show_bug.cgi?id=CVE-2020-7040Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2020/02/msg00003.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://seclists.org/oss-sec/2020/q1/20Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4508-1/Third Party Advisory
Impacted products
Vendor Product Version
storebackup storebackup *
debian debian_linux 8.0
opensuse backports_sle 15.0
opensuse backports_sle 15.0
opensuse leap 15.1
canonical ubuntu_linux 16.04
canonical ubuntu_linux 18.04
canonical ubuntu_linux 20.04


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DE7E53EF-C72C-45D2-84DD-C8AE96F4833D",
              "versionEndIncluding": "3.5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "76977883-4C5F-4911-93AC-88877112D371",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "40513095-7E6E-46B3-B604-C926F1BA3568",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
              "matchCriteriaId": "7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
              "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*",
              "matchCriteriaId": "902B8056-9E37-443B-8905-8AA93E2447FB",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "storeBackup.pl in storeBackup through 3.5 relies on the /tmp/storeBackup.lock pathname, which allows symlink attacks that possibly lead to privilege escalation. (Local users can also create a plain file named /tmp/storeBackup.lock to block use of storeBackup until an admin manually deletes that file.)"
    },
    {
      "lang": "es",
      "value": "El archivo storeBackup.pl en storeBackup versiones hasta 3.5, se basa en el nombre de ruta /tmp/storeBackup.lock, que permite ataques de tipo symlink que posiblemente conllevan a una escalada de privilegios. (Los usuarios locales tambi\u00e9n pueden crear un archivo simple llamado /tmp/storeBackup.lock para bloquear el uso de storeBackup hasta que un administrador elimine manualmente ese archivo)."
    }
  ],
  "id": "CVE-2020-7040",
  "lastModified": "2024-11-21T05:36:32.217",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.3,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-01-21T21:15:16.443",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mailing List",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00054.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2020/01/20/3"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2020/01/21/2"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2020/01/22/2"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2020/01/22/3"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2020/01/23/1"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2020-7040"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00003.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://seclists.org/oss-sec/2020/q1/20"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://usn.ubuntu.com/4508-1/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00054.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2020/01/20/3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2020/01/21/2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2020/01/22/2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2020/01/22/3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2020/01/23/1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2020-7040"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00003.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://seclists.org/oss-sec/2020/q1/20"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://usn.ubuntu.com/4508-1/"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2005-10-05 21:02
Modified
2024-11-21 00:01
Severity ?
Summary
StoreBackup before 1.19 allows local users to perform unauthorized operations on arbitrary files via a symlink attack on temporary files.
References
cve@mitre.orghttp://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332434
cve@mitre.orghttp://secunia.com/advisories/17025
cve@mitre.orghttp://secunia.com/advisories/19489
cve@mitre.orghttp://sourceforge.net/project/shownotes.php?release_id=352676Patch
cve@mitre.orghttp://www.securityfocus.com/advisories/9384Vendor Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/14985Patch
cve@mitre.orghttp://www.us.debian.org/security/2006/dsa-1022
af854a3a-2127-422b-91ae-364da2661108http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332434
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/17025
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/19489
af854a3a-2127-422b-91ae-364da2661108http://sourceforge.net/project/shownotes.php?release_id=352676Patch
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/advisories/9384Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/14985Patch
af854a3a-2127-422b-91ae-364da2661108http://www.us.debian.org/security/2006/dsa-1022
Impacted products
Vendor Product Version
storebackup storebackup 1.1
storebackup storebackup 1.2
storebackup storebackup 1.3
storebackup storebackup 1.4
storebackup storebackup 1.5
storebackup storebackup 1.6
storebackup storebackup 1.7
storebackup storebackup 1.8
storebackup storebackup 1.8.1
storebackup storebackup 1.9
storebackup storebackup 1.9.1
storebackup storebackup 1.10
storebackup storebackup 1.10.1
storebackup storebackup 1.11
storebackup storebackup 1.12
storebackup storebackup 1.12.1
storebackup storebackup 1.12.2
storebackup storebackup 1.13
storebackup storebackup 1.14
storebackup storebackup 1.15
storebackup storebackup 1.16
storebackup storebackup 1.16.1
storebackup storebackup 1.16.2
storebackup storebackup 1.17
storebackup storebackup 1.18
storebackup storebackup 1.18.1
storebackup storebackup 1.18.2
storebackup storebackup 1.18.3
storebackup storebackup 1.18.4
suse suse_linux *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "56A5B037-A737-472C-866F-F86EEEDF30D9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "E7F7732C-040D-4DA3-8F02-3F651DBB8752",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F60E29E-45A2-49C3-A8F7-CDF42300A7A6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "8AB0D75A-D55D-4846-B581-47398344BD39",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "D2A62393-39F7-45B9-9969-EF328B6804FF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "D2009E5F-8C8F-4A91-AEDB-FC7144364C88",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "5531AA6C-C729-4910-8FC0-11B27D942AFC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "750899E8-04DF-4594-BD7F-4A2044233C71",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.8.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "BAE30852-D827-47D5-94F9-6BDA1358C2F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "88417E27-47E3-4C4C-BAC9-3C1639F99388",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.9.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "A7FF3CCC-AC43-410F-958A-6E0FA23FD2F9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F77A5E1-A4A6-4699-A18B-FDE941402749",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.10.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "4034B2BF-3A2C-4A6A-A5E9-A93816AD7CE7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "00FD7AB3-2BFF-45F5-8962-8E3E87EF5C36",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "8F668721-FDE7-48FA-ABDE-FE036467CCCB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.12.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "7DE5598E-0478-4D6F-AE78-55F55470DCEA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.12.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "AAF78954-AD7E-441B-A514-83300738BCA7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "37953139-D103-4371-8015-4363869BF359",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "6D0FBB65-804F-4A4C-9D1F-940731C187CE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "228A7BFD-C097-4225-B43B-877729E87519",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.16:*:*:*:*:*:*:*",
              "matchCriteriaId": "F8504BF7-89C4-45C6-A6F2-1674CF4CC7E3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.16.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "17C2B452-2333-47E2-961E-753CDE5AC064",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.16.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "B0EF03CA-39D8-4FD5-B68F-96CD953F70EC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "AAA9FC18-076D-4DA6-A3C0-CB5182F60D4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.18:*:*:*:*:*:*:*",
              "matchCriteriaId": "0EED05AB-16BD-4547-98C9-123EDDA40EC0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.18.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "436D746E-A601-4063-B11A-ADF5D71B0D85",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.18.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "69875274-9655-4395-9A94-BC743C673604",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.18.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "1A5DA6A5-9842-4483-B0C0-9C79B775E85F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.18.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "0871F4C9-ED38-4184-9537-5044C06D5769",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:suse:suse_linux:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "67527281-81FA-4068-9E0A-7B19FB6A208A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "StoreBackup before 1.19 allows local users to perform unauthorized operations on arbitrary files via a symlink attack on temporary files."
    }
  ],
  "id": "CVE-2005-3146",
  "lastModified": "2024-11-21T00:01:13.277",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 2.1,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2005-10-05T21:02:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332434"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/17025"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/19489"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://sourceforge.net/project/shownotes.php?release_id=352676"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.securityfocus.com/advisories/9384"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/14985"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.us.debian.org/security/2006/dsa-1022"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332434"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/17025"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/19489"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://sourceforge.net/project/shownotes.php?release_id=352676"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.securityfocus.com/advisories/9384"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/14985"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.us.debian.org/security/2006/dsa-1022"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2005-10-05 21:02
Modified
2024-11-21 00:01
Severity ?
Summary
StoreBackup before 1.19 creates the backup root with world-readable permissions, which allows local users to obtain sensitive information.
References
cve@mitre.orghttp://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332434
cve@mitre.orghttp://secunia.com/advisories/17025
cve@mitre.orghttp://secunia.com/advisories/19489
cve@mitre.orghttp://sourceforge.net/project/shownotes.php?release_id=352676Patch
cve@mitre.orghttp://www.securityfocus.com/advisories/9384Vendor Advisory
cve@mitre.orghttp://www.us.debian.org/security/2006/dsa-1022
af854a3a-2127-422b-91ae-364da2661108http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332434
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/17025
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/19489
af854a3a-2127-422b-91ae-364da2661108http://sourceforge.net/project/shownotes.php?release_id=352676Patch
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/advisories/9384Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.us.debian.org/security/2006/dsa-1022
Impacted products
Vendor Product Version
storebackup storebackup 1.1
storebackup storebackup 1.2
storebackup storebackup 1.3
storebackup storebackup 1.4
storebackup storebackup 1.5
storebackup storebackup 1.6
storebackup storebackup 1.7
storebackup storebackup 1.8
storebackup storebackup 1.8.1
storebackup storebackup 1.9
storebackup storebackup 1.9.1
storebackup storebackup 1.10
storebackup storebackup 1.10.1
storebackup storebackup 1.11
storebackup storebackup 1.12
storebackup storebackup 1.12.1
storebackup storebackup 1.12.2
storebackup storebackup 1.13
storebackup storebackup 1.14
storebackup storebackup 1.15
storebackup storebackup 1.16
storebackup storebackup 1.16.1
storebackup storebackup 1.16.2
storebackup storebackup 1.17
storebackup storebackup 1.18
storebackup storebackup 1.18.1
storebackup storebackup 1.18.2
storebackup storebackup 1.18.3
storebackup storebackup 1.18.4
suse suse_linux *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "56A5B037-A737-472C-866F-F86EEEDF30D9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "E7F7732C-040D-4DA3-8F02-3F651DBB8752",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F60E29E-45A2-49C3-A8F7-CDF42300A7A6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "8AB0D75A-D55D-4846-B581-47398344BD39",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "D2A62393-39F7-45B9-9969-EF328B6804FF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "D2009E5F-8C8F-4A91-AEDB-FC7144364C88",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "5531AA6C-C729-4910-8FC0-11B27D942AFC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "750899E8-04DF-4594-BD7F-4A2044233C71",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.8.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "BAE30852-D827-47D5-94F9-6BDA1358C2F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "88417E27-47E3-4C4C-BAC9-3C1639F99388",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.9.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "A7FF3CCC-AC43-410F-958A-6E0FA23FD2F9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F77A5E1-A4A6-4699-A18B-FDE941402749",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.10.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "4034B2BF-3A2C-4A6A-A5E9-A93816AD7CE7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "00FD7AB3-2BFF-45F5-8962-8E3E87EF5C36",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "8F668721-FDE7-48FA-ABDE-FE036467CCCB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.12.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "7DE5598E-0478-4D6F-AE78-55F55470DCEA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.12.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "AAF78954-AD7E-441B-A514-83300738BCA7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "37953139-D103-4371-8015-4363869BF359",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "6D0FBB65-804F-4A4C-9D1F-940731C187CE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "228A7BFD-C097-4225-B43B-877729E87519",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.16:*:*:*:*:*:*:*",
              "matchCriteriaId": "F8504BF7-89C4-45C6-A6F2-1674CF4CC7E3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.16.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "17C2B452-2333-47E2-961E-753CDE5AC064",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.16.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "B0EF03CA-39D8-4FD5-B68F-96CD953F70EC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "AAA9FC18-076D-4DA6-A3C0-CB5182F60D4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.18:*:*:*:*:*:*:*",
              "matchCriteriaId": "0EED05AB-16BD-4547-98C9-123EDDA40EC0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.18.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "436D746E-A601-4063-B11A-ADF5D71B0D85",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.18.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "69875274-9655-4395-9A94-BC743C673604",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.18.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "1A5DA6A5-9842-4483-B0C0-9C79B775E85F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.18.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "0871F4C9-ED38-4184-9537-5044C06D5769",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:suse:suse_linux:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "67527281-81FA-4068-9E0A-7B19FB6A208A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "StoreBackup before 1.19 creates the backup root with world-readable permissions, which allows local users to obtain sensitive information."
    }
  ],
  "id": "CVE-2005-3147",
  "lastModified": "2024-11-21T00:01:13.407",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 2.1,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2005-10-05T21:02:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332434"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/17025"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/19489"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://sourceforge.net/project/shownotes.php?release_id=352676"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.securityfocus.com/advisories/9384"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.us.debian.org/security/2006/dsa-1022"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332434"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/17025"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/19489"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://sourceforge.net/project/shownotes.php?release_id=352676"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.securityfocus.com/advisories/9384"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.us.debian.org/security/2006/dsa-1022"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2005-10-05 21:02
Modified
2024-11-21 00:01
Severity ?
Summary
StoreBackup before 1.19 does not properly set the uid and guid for symbolic links (1) that are backed up by storeBackup.pl, or (2) recovered by storeBackupRecover.pl, which could cause files to be restored with incorrect ownership.
References
cve@mitre.orghttp://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332434
cve@mitre.orghttp://secunia.com/advisories/17025
cve@mitre.orghttp://secunia.com/advisories/19489
cve@mitre.orghttp://sourceforge.net/project/shownotes.php?release_id=352676Patch, Vendor Advisory
cve@mitre.orghttp://www.securityfocus.com/advisories/9384Vendor Advisory
cve@mitre.orghttp://www.us.debian.org/security/2006/dsa-1022
af854a3a-2127-422b-91ae-364da2661108http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332434
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/17025
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/19489
af854a3a-2127-422b-91ae-364da2661108http://sourceforge.net/project/shownotes.php?release_id=352676Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/advisories/9384Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.us.debian.org/security/2006/dsa-1022
Impacted products
Vendor Product Version
storebackup storebackup 1.1
storebackup storebackup 1.2
storebackup storebackup 1.3
storebackup storebackup 1.4
storebackup storebackup 1.5
storebackup storebackup 1.6
storebackup storebackup 1.7
storebackup storebackup 1.8
storebackup storebackup 1.8.1
storebackup storebackup 1.9
storebackup storebackup 1.9.1
storebackup storebackup 1.10
storebackup storebackup 1.10.1
storebackup storebackup 1.11
storebackup storebackup 1.12
storebackup storebackup 1.12.1
storebackup storebackup 1.12.2
storebackup storebackup 1.13
storebackup storebackup 1.14
storebackup storebackup 1.15
storebackup storebackup 1.16
storebackup storebackup 1.16.1
storebackup storebackup 1.16.2
storebackup storebackup 1.17
storebackup storebackup 1.18
storebackup storebackup 1.18.1
storebackup storebackup 1.18.2
storebackup storebackup 1.18.3
storebackup storebackup 1.18.4
suse suse_linux *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "56A5B037-A737-472C-866F-F86EEEDF30D9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "E7F7732C-040D-4DA3-8F02-3F651DBB8752",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F60E29E-45A2-49C3-A8F7-CDF42300A7A6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "8AB0D75A-D55D-4846-B581-47398344BD39",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "D2A62393-39F7-45B9-9969-EF328B6804FF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "D2009E5F-8C8F-4A91-AEDB-FC7144364C88",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "5531AA6C-C729-4910-8FC0-11B27D942AFC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "750899E8-04DF-4594-BD7F-4A2044233C71",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.8.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "BAE30852-D827-47D5-94F9-6BDA1358C2F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "88417E27-47E3-4C4C-BAC9-3C1639F99388",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.9.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "A7FF3CCC-AC43-410F-958A-6E0FA23FD2F9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F77A5E1-A4A6-4699-A18B-FDE941402749",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.10.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "4034B2BF-3A2C-4A6A-A5E9-A93816AD7CE7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "00FD7AB3-2BFF-45F5-8962-8E3E87EF5C36",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "8F668721-FDE7-48FA-ABDE-FE036467CCCB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.12.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "7DE5598E-0478-4D6F-AE78-55F55470DCEA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.12.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "AAF78954-AD7E-441B-A514-83300738BCA7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "37953139-D103-4371-8015-4363869BF359",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "6D0FBB65-804F-4A4C-9D1F-940731C187CE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "228A7BFD-C097-4225-B43B-877729E87519",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.16:*:*:*:*:*:*:*",
              "matchCriteriaId": "F8504BF7-89C4-45C6-A6F2-1674CF4CC7E3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.16.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "17C2B452-2333-47E2-961E-753CDE5AC064",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.16.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "B0EF03CA-39D8-4FD5-B68F-96CD953F70EC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "AAA9FC18-076D-4DA6-A3C0-CB5182F60D4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.18:*:*:*:*:*:*:*",
              "matchCriteriaId": "0EED05AB-16BD-4547-98C9-123EDDA40EC0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.18.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "436D746E-A601-4063-B11A-ADF5D71B0D85",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.18.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "69875274-9655-4395-9A94-BC743C673604",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.18.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "1A5DA6A5-9842-4483-B0C0-9C79B775E85F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:storebackup:storebackup:1.18.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "0871F4C9-ED38-4184-9537-5044C06D5769",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:suse:suse_linux:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "67527281-81FA-4068-9E0A-7B19FB6A208A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "StoreBackup before 1.19 does not properly set the uid and guid for symbolic links (1) that are backed up by storeBackup.pl, or (2) recovered by storeBackupRecover.pl, which could cause files to be restored with incorrect ownership."
    }
  ],
  "id": "CVE-2005-3148",
  "lastModified": "2024-11-21T00:01:13.537",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 4.6,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2005-10-05T21:02:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332434"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/17025"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/19489"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://sourceforge.net/project/shownotes.php?release_id=352676"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.securityfocus.com/advisories/9384"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.us.debian.org/security/2006/dsa-1022"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332434"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/17025"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/19489"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://sourceforge.net/project/shownotes.php?release_id=352676"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.securityfocus.com/advisories/9384"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.us.debian.org/security/2006/dsa-1022"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}