Description
Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which may lead to escalation of privileges, denial of service, and information disclosure.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | amanda | 1:3.5.1-10 | — |
| Debian 13 | amanda | 1:3.5.1-10 | — |
| Debian 12 | amanda | 1:3.5.1-10 | — |
| Debian 11 | amanda | 1:3.5.1-7+deb11u1 | DLA-3880-1 |
| Debian 10 | amanda | 1:3.5.1-2+deb10u1 | DLA-3330-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | amanda | 1:3.5.1-8ubuntu1.3 | USN-5966-3, USN-5966-1 |
| Ubuntu 20.04 LTS | amanda | 1:3.5.1-2ubuntu0.3 | USN-5966-3, USN-5966-1 |
| Ubuntu 18.04 LTS | amanda | 1:3.5.1-1ubuntu0.3 | USN-5966-3, USN-5966-1 |
| Ubuntu 16.04 LTS | amanda | 1:3.3.6-4.1ubuntu0.1 | USN-5966-1 |
| Ubuntu 14.04 LTS | amanda | 1:3.3.3-2ubuntu1.1+esm1 | USN-5966-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | amanda | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP4 | amanda | 3.5.1-bp154.3.3.1 | openSUSE-SU-2023:0069-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | amanda | 3.5.3-1.1 | openSUSE-SU-2024:12808-1 |
| openSUSE Leap 15.4 | amanda | 3.5.1-bp154.3.3.1 | openSUSE-SU-2023:0069-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
MaherAzzouzi/CVE-2022-37704 ★ 4 · Oct 23, 2022
Amanda 3.5.1 LPE
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 6
- DLA-3880-1 amanda - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3330-1 amanda - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-5966-1 amanda vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- USN-5966-3 amanda regression Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2024:12808-1 amanda-3.5.3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2023:0069-1 Security update for amanda SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://www.amanda.org/
- https://github.com/MaherAzzouzi/CVE-2022-37704
- https://github.com/zmanda/amanda/issues/192
- https://marc.info/?l=amanda-hackers
- [debian-lts-announce] 20230221 [SECURITY] [DLA 3330-1] amanda security update mailing-list
- FEDORA-2023-3d0619d767 vendor-advisory
- FEDORA-2023-1293196f34 vendor-advisory
- FEDORA-2023-e295804b3d vendor-advisory
- https://github.com/zmanda/amanda/pull/197
- https://github.com/zmanda/amanda/pull/205
- https://github.com/zmanda/amanda/releases/tag/tag-community-3.5.3