Description
The dump_resource function in dird/dird_conf.c in Bacula before 5.2.11 does not properly enforce ACL rules, which allows remote authenticated users to obtain resource dump information via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bacula | 5.2.6+dfsg-4 | — |
| Debian 13 | bacula | 5.2.6+dfsg-4 | — |
| Debian 12 | bacula | 5.2.6+dfsg-4 | — |
| Debian 6.0 | bacula | 5.0.2-2.2+squeeze1 | DSA-2558-1 |
Advisories 1
- DSA-2558-1 bacula - information disclosure Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://sourceforge.net/projects/bacula/files/bacula/5.2.12/ReleaseNotes/view
- DSA-2558 vendor-advisory
- [oss-security] 20120914 Re: Re: CVE request: bacula: Console ACL Bypass mailing-list
- MDVSA-2012:166 vendor-advisory
- http://www.bacula.org/en/?page=news
- 55505 vdb-entry
- 50535 third-party-advisory
- http://www.bacula.org/git/cgit.cgi/bacula/commit/?id=67debcecd3d530c429e817e1d778e79dcd1db905
- 50808 third-party-advisory
- [oss-security] 20120914 Re: CVE request: bacula: Console ACL Bypass mailing-list
- [oss-security] 20120914 CVE request: bacula: Console ACL Bypass mailing-list