CVE-2009-3369

CgiUserConfigEdit in BackupPC 3.1.0, when SSH keys and Rsync are in use in a multi-user environment, does not restrict users from the ClientNameAlias function, which allows remote authenticated users to read and write sensitive files by modifying ClientNameAlias to match another system, then initiating a backup or restore.

🔗 References (14)

• cve@mitrehttp://bugs.debian.org/cgi-bin/bugreport.cgi?bug=542218
• cve@mitrehttp://osvdb.org/57236
• cve@mitrehttp://secunia.com/advisories/36393
• cve@mitrehttp://secunia.com/advisories/37161
• cve@mitrehttps://bugzilla.redhat.com/show_bug.cgi?id=518412
• cve@mitrehttps://www.redhat.com/archives/fedora-package-announce/2009-October/msg00694.html
• cve@mitrehttps://www.redhat.com/archives/fedora-package-announce/2009-October/msg00729.html
• af854a3a-2127-422b-91ae-364da2661108http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=542218
• af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/57236
• af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/36393
• af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/37161
• af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=518412
• af854a3a-2127-422b-91ae-364da2661108https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00694.html
• af854a3a-2127-422b-91ae-364da2661108https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00729.html