CVE-2009-3611

common/snapshots.py in Back In Time (aka backintime) 0.9.26 changes certain permissions to 0777 before deleting the files in an old backup snapshot, which allows local users to obtain sensitive information by reading these files, or interfere with backup integrity by modifying files that are shared across snapshots.

CVSS v2.0 3.6 LOW

3.6^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:N

Exploitability : 3.9 / Impact : 4.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://bugzilla.redhat.com/show_bug.cgi?id=520210
https://bugs.launchpad.net/ubuntu/+source/backintime/+bug/434256
http://bugs.gentoo.org/show_bug.cgi?id=289047	Patch
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=543785
https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00821.html
http://marc.info/?l=oss-security&m=125554894700336&w=2
https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00823.html
http://marc.info/?l=oss-security&m=125553645511436&w=2
http://ftp.debian.org/debian/pool/main/b/backintime/backintime_0.9.26-3.diff.gz	Patch

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:le-web:backintime:0.9.26:*:*:*:*:*:*:*

Information

Published : 2009-10-26 09:30

Updated : 2009-10-26 09:30

NVD link : CVE-2009-3611

Mitre link : CVE-2009-3611

JSON object : View

CWE

CWE-264

Permissions, Privileges, and Access Controls

Advertisement

Products Affected

le-web

backintime

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=520210", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=520210", "tags": [], "refsource": "CONFIRM"}, {"url": "https://bugs.launchpad.net/ubuntu/+source/backintime/+bug/434256", "name": "https://bugs.launchpad.net/ubuntu/+source/backintime/+bug/434256", "tags": [], "refsource": "CONFIRM"}, {"url": "http://bugs.gentoo.org/show_bug.cgi?id=289047", "name": "http://bugs.gentoo.org/show_bug.cgi?id=289047", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=543785", "name": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=543785", "tags": [], "refsource": "CONFIRM"}, {"url": "https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00821.html", "name": "FEDORA-2009-9282", "tags": [], "refsource": "FEDORA"}, {"url": "http://marc.info/?l=oss-security&m=125554894700336&w=2", "name": "[oss-security] 20091014 Re: CVE Request - backintime", "tags": [], "refsource": "MLIST"}, {"url": "https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00823.html", "name": "FEDORA-2009-9298", "tags": [], "refsource": "FEDORA"}, {"url": "http://marc.info/?l=oss-security&m=125553645511436&w=2", "name": "[oss-security] 20091014 CVE Request - backintime", "tags": [], "refsource": "MLIST"}, {"url": "http://ftp.debian.org/debian/pool/main/b/backintime/backintime_0.9.26-3.diff.gz", "name": "http://ftp.debian.org/debian/pool/main/b/backintime/backintime_0.9.26-3.diff.gz", "tags": ["Patch"], "refsource": "CONFIRM"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "common/snapshots.py in Back In Time (aka backintime) 0.9.26 changes certain permissions to 0777 before deleting the files in an old backup snapshot, which allows local users to obtain sensitive information by reading these files, or interfere with backup integrity by modifying files that are shared across snapshots."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-264"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2009-3611", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 3.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "LOW", "impactScore": 4.9, "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2009-10-26T16:30Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:le-web:backintime:0.9.26:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2009-10-26T16:30Z"}