CVE-2009-3611 — HIGH (7.1) — White Hats Nepal

Vulnerability Description

common/snapshots.py in Back In Time (aka backintime) 0.9.26 changes certain permissions to 0777 before deleting the files in an old backup snapshot, which allows local users to obtain sensitive information by reading these files, or interfere with backup integrity by modifying files that are shared across snapshots.

CVSS Score

7.1

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Le-Web	Backintime	0.9.26
Fedoraproject	Fedora	10

Related Weaknesses (CWE)

CWE-732

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=543785Mailing List
http://bugs.gentoo.org/show_bug.cgi?id=289047Issue TrackingPatch
http://ftp.debian.org/debian/pool/main/b/backintime/backintime_0.9.26-3.diff.gzBroken LinkPatch
http://marc.info/?l=oss-security&m=125553645511436&w=2Mailing List
http://marc.info/?l=oss-security&m=125554894700336&w=2Mailing List
https://bugs.launchpad.net/ubuntu/+source/backintime/+bug/434256Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=520210Issue Tracking
https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00821.Mailing List
https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00823.Mailing List
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=543785Mailing List
http://bugs.gentoo.org/show_bug.cgi?id=289047Issue TrackingPatch
http://ftp.debian.org/debian/pool/main/b/backintime/backintime_0.9.26-3.diff.gzBroken LinkPatch
http://marc.info/?l=oss-security&m=125553645511436&w=2Mailing List
http://marc.info/?l=oss-security&m=125554894700336&w=2Mailing List
https://bugs.launchpad.net/ubuntu/+source/backintime/+bug/434256Third Party Advisory

FAQ

What is CVE-2009-3611?

CVE-2009-3611 is a vulnerability with a CVSS score of 7.1 (HIGH). common/snapshots.py in Back In Time (aka backintime) 0.9.26 changes certain permissions to 0777 before deleting the files in an old backup snapshot, which allows local users to obtain sensitive inform...

How severe is CVE-2009-3611?

CVE-2009-3611 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2009-3611?

Check the references section above for vendor advisories and patch information. Affected products include: Le-Web Backintime, Fedoraproject Fedora.