Rdiff-backup Directory Access Restriction Bypass Vulnerability

Bugtraq ID:	14804
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 12 2005 12:00AM
Updated:	Sep 12 2005 12:00AM
Credit:	Reported by the vendor.
Vulnerable:	rdiff-backup rdiff-backup 1.0
Not Vulnerable:	rdiff-backup rdiff-backup 1.0.1

Rdiff-backup Directory Access Restriction Bypass Vulnerability

rdiff-backup is affected by a directory access restriction bypass vulnerability.

A successful attack can allow an attacker to obtain directory listings and write files outside the restricted path.

rdiff-backup 1.0 and prior versions are vulnerable to this issue.

Rdiff-backup Directory Access Restriction Bypass Vulnerability

An exploit is not required.

Rdiff-backup Directory Access Restriction Bypass Vulnerability

Solution:
The vendor has released rdiff-backup 1.0.1 to address this issue.


rdiff-backup rdiff-backup 1.0

• rdiff-backup rdiff-backup-1.0.1.tar.gz
  http://savannah.nongnu.org/download/rdiff-backup/rdiff-backup-1.0.1.ta r.gz

Rdiff-backup Directory Access Restriction Bypass Vulnerability

References:

• rdiff-backup Change Log (rdiff-backup)
  
• rdiff-backup Product Page (rdiff-backup)