Skip to content
OpenAdvisories
Unscored Public exploit CVE-2022-37705 EUVD-2022-40319GHSA-f6f6-98vp-w8mf

A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root privileges. The vulnerable component is the…

Published Apr 16, 2023 · Updated Nov 4, 2025 · Assigned by mitre

Package: amanda Package: amanda Ecosystem: Debian Ecosystem: Ubuntu

Description

A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar with specific arguments that are controllable by the attacker. This program mishandles the arguments passed to tar binary (it expects that the argument name and value are separated with a space; however, separating them with an equals sign is also supported),

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 amanda 1:3.5.1-10 —
Debian 13 amanda 1:3.5.1-10 —
Debian 12 amanda 1:3.5.1-10 —
Debian 11 amanda 1:3.5.1-7+deb11u1 DLA-3880-1
Debian 10 amanda 1:3.5.1-2+deb10u2 DLA-3681-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS amanda 1:3.5.1-8ubuntu1.3 USN-5966-3, USN-5966-1
Ubuntu 20.04 LTS amanda 1:3.5.1-2ubuntu0.3 USN-5966-3, USN-5966-1
Ubuntu 18.04 LTS amanda 1:3.5.1-1ubuntu0.3 USN-5966-3, USN-5966-1
Ubuntu 16.04 LTS amanda 1:3.3.6-4.1ubuntu0.1 USN-5966-1
Ubuntu 14.04 LTS amanda 1:3.3.3-2ubuntu1.1+esm1 USN-5966-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 16.04 LTS amanda No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SUSE Package Hub 15 SP4 amanda 3.5.1-bp154.3.3.1 openSUSE-SU-2023:0069-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed amanda 3.5.2-3.1 openSUSE-SU-2024:12706-1
openSUSE Leap 15.4 amanda 3.5.1-bp154.3.3.1 openSUSE-SU-2023:0069-1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 6

References