CVE-2022-37703

In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use `opendir()` as root directly without checking the path, letting the attacker provide an arbitrary path.

Link	Resource
http://www.amanda.org/	Vendor Advisory
https://github.com/MaherAzzouzi/CVE-2022-37703	Third Party Advisory
https://bugs.gentoo.org/870037	Third Party Advisory

Configuration 1

cpe:2.3:a:amanda:amanda:3.5.1:*:*:*:*:*:*:*

---

Published : 2022-09-13 08:15

Updated : 2022-10-01 02:14

---

NVD link : CVE-2022-37703

Mitre link : CVE-2022-37703

No products.

CWE-668