Vulnerability Name:

CVE-2005-3147 (CCN-22464)

Assigned:2005-09-30
Published:2005-09-30
Updated:2008-09-05
Summary:StoreBackup before 1.19 creates the backup root with world-readable permissions, which allows local users to obtain sensitive information.
CVSS v3 Severity:4.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
2.1 Low (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-Other
Vulnerability Consequences:Obtain Information
References:Source: MISC
Type: UNKNOWN
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332434

Source: MITRE
Type: CNA
CVE-2005-3147

Source: CCN
Type: storebackup Web site
storebackup

Source: CCN
Type: SA17025
storeBackup Insecure Temporary File Creation and Insecure Backup Root Permissions

Source: SECUNIA
Type: UNKNOWN
17025

Source: SECUNIA
Type: UNKNOWN
19489

Source: CONFIRM
Type: Patch
http://sourceforge.net/project/shownotes.php?release_id=352676

Source: DEBIAN
Type: DSA-1022
storebackup -- several vulnerabilities

Source: CCN
Type: OSVDB ID: 19737
storeBackup Backup root Directory Permission Weakness

Source: SUSE
Type: Vendor Advisory
SUSE-SR:2005:021

Source: DEBIAN
Type: UNKNOWN
DSA-1022

Source: XF
Type: UNKNOWN
storebackup-root-directory-file-permissions(22464)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:storebackup:storebackup:1.1:*:*:*:*:*:*:*
  • OR cpe:/a:storebackup:storebackup:1.2:*:*:*:*:*:*:*
  • OR cpe:/a:storebackup:storebackup:1.3:*:*:*:*:*:*:*
  • OR cpe:/a:storebackup:storebackup:1.4:*:*:*:*:*:*:*
  • OR cpe:/a:storebackup:storebackup:1.5:*:*:*:*:*:*:*
  • OR cpe:/a:storebackup:storebackup:1.6:*:*:*:*:*:*:*
  • OR cpe:/a:storebackup:storebackup:1.7:*:*:*:*:*:*:*
  • OR cpe:/a:storebackup:storebackup:1.8:*:*:*:*:*:*:*
  • OR cpe:/a:storebackup:storebackup:1.8.1:*:*:*:*:*:*:*
  • OR cpe:/a:storebackup:storebackup:1.9:*:*:*:*:*:*:*
  • OR cpe:/a:storebackup:storebackup:1.9.1:*:*:*:*:*:*:*
  • OR cpe:/a:storebackup:storebackup:1.10:*:*:*:*:*:*:*
  • OR cpe:/a:storebackup:storebackup:1.10.1:*:*:*:*:*:*:*
  • OR cpe:/a:storebackup:storebackup:1.11:*:*:*:*:*:*:*
  • OR cpe:/a:storebackup:storebackup:1.12:*:*:*:*:*:*:*
  • OR cpe:/a:storebackup:storebackup:1.12.1:*:*:*:*:*:*:*
  • OR cpe:/a:storebackup:storebackup:1.12.2:*:*:*:*:*:*:*
  • OR cpe:/a:storebackup:storebackup:1.13:*:*:*:*:*:*:*
  • OR cpe:/a:storebackup:storebackup:1.14:*:*:*:*:*:*:*
  • OR cpe:/a:storebackup:storebackup:1.15:*:*:*:*:*:*:*
  • OR cpe:/a:storebackup:storebackup:1.16:*:*:*:*:*:*:*
  • OR cpe:/a:storebackup:storebackup:1.16.1:*:*:*:*:*:*:*
  • OR cpe:/a:storebackup:storebackup:1.16.2:*:*:*:*:*:*:*
  • OR cpe:/a:storebackup:storebackup:1.17:*:*:*:*:*:*:*
  • OR cpe:/a:storebackup:storebackup:1.18:*:*:*:*:*:*:*
  • OR cpe:/a:storebackup:storebackup:1.18.1:*:*:*:*:*:*:*
  • OR cpe:/a:storebackup:storebackup:1.18.2:*:*:*:*:*:*:*
  • OR cpe:/a:storebackup:storebackup:1.18.3:*:*:*:*:*:*:*
  • OR cpe:/a:storebackup:storebackup:1.18.4:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:suse:suse_linux:*:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.debian:def:1022
    V
    		several vulnerabilities
    2006-04-04
    BACK
    storebackup storebackup 1.1
    storebackup storebackup 1.2
    storebackup storebackup 1.3
    storebackup storebackup 1.4
    storebackup storebackup 1.5
    storebackup storebackup 1.6
    storebackup storebackup 1.7
    storebackup storebackup 1.8
    storebackup storebackup 1.8.1
    storebackup storebackup 1.9
    storebackup storebackup 1.9.1
    storebackup storebackup 1.10
    storebackup storebackup 1.10.1
    storebackup storebackup 1.11
    storebackup storebackup 1.12
    storebackup storebackup 1.12.1
    storebackup storebackup 1.12.2
    storebackup storebackup 1.13
    storebackup storebackup 1.14
    storebackup storebackup 1.15
    storebackup storebackup 1.16
    storebackup storebackup 1.16.1
    storebackup storebackup 1.16.2
    storebackup storebackup 1.17
    storebackup storebackup 1.18
    storebackup storebackup 1.18.1
    storebackup storebackup 1.18.2
    storebackup storebackup 1.18.3
    storebackup storebackup 1.18.4
    suse suse linux *