CVE-2009-3369

Published: Sep 24, 2009Modified: Apr 23, 2026

8.5

Vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Exploitability: 6.8 / Impact: 10.0

Source: NVD

Description

CgiUserConfigEdit in BackupPC 3.1.0, when SSH keys and Rsync are in use in a multi-user environment, does not restrict users from the ClientNameAlias function, which allows remote authenticated users to read and write sensitive files by modifying ClientNameAlias to match another system, then initiating a backup or restore.

Affected (1)

Products: Backuppc: Backuppc

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Backuppc Backuppc	Version 3.1.0

Related CWEs

References (14)

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=542218

Source: cve@mitre.org

http://osvdb.org/57236

Source: cve@mitre.org

http://secunia.com/advisories/36393

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/37161

Source: cve@mitre.org

https://bugzilla.redhat.com/show_bug.cgi?id=518412

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00694.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00729.html

Source: cve@mitre.org

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=542218

Source: af854a3a-2127-422b-91ae-364da2661108

http://osvdb.org/57236

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/36393

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/37161

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=518412

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00694.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00729.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.