NVD

Id
50573  
Name
CVE-2009-3369  
Description
CgiUserConfigEdit in BackupPC 3.1.0, when SSH keys and Rsync are in use in a multi-user environment, does not restrict users from the ClientNameAlias function, which allows remote authenticated users to read and write sensitive files by modifying ClientNameAlias to match another system, then initiating a backup or restore.  
Reject
 
CVSS Version
2  
CVSS Score
8.5  
Severity
High  
CVSS Base Score
8.5  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
6.8  
CVSS Vector
(AV:N/AC:M/Au:S/C:C/I:C/A:C)  
Pub Date
2017-01-07  
Published
2009-09-24  
Modified Date
2009-10-31  
Seq
2009-3369  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
255666 50573 CVE-2009-3369 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=542218  View
255667 50573 CVE-2009-3369 https://bugzilla.redhat.com/show_bug.cgi?id=518412  View
255668 50573 CVE-2009-3369 FEDORA-2009-9982  View
255669 50573 CVE-2009-3369 FEDORA-2009-9973  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
42778 JVNDB-2009-003785 BackupPC の CgiUserConfigEdit における重要なファイルを読み書きされる脆弱性 BackupPC の CgiUserConfigEdit は、SSH 鍵および Rsync がマルチユーザ環境下で使用される際、ClientNameAlias 関数からユーザ制限をしないため、重要なファイルを読み書きされる脆弱性が存在します。 CVE-2009-3369 40800 CVE-2009-3369 50573 8.5 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-003785.html 2009-09-24 2012-06-26 View