CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:P/A:N
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
AI Score
Confidence
High
EPSS
Percentile
5.1%
common/snapshots.py in Back In Time (aka backintime) 0.9.26 changes certain permissions to 0777 before deleting the files in an old backup snapshot, which allows local users to obtain sensitive information by reading these files, or interfere with backup integrity by modifying files that are shared across snapshots.
Vendor | Product | Version | CPE |
---|---|---|---|
le-web | backintime | 0.9.26 | cpe:2.3:a:le-web:backintime:0.9.26:*:*:*:*:*:*:* |
fedoraproject | fedora | 10 | cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:* |
fedoraproject | fedora | 11 | cpe:2.3:o:fedoraproject:fedora:11:*:*:*:*:*:*:* |
bugs.debian.org/cgi-bin/bugreport.cgi?bug=543785
bugs.gentoo.org/show_bug.cgi?id=289047
ftp.debian.org/debian/pool/main/b/backintime/backintime_0.9.26-3.diff.gz
marc.info/?l=oss-security&m=125553645511436&w=2
marc.info/?l=oss-security&m=125554894700336&w=2
bugs.launchpad.net/ubuntu/+source/backintime/+bug/434256
bugzilla.redhat.com/show_bug.cgi?id=520210
www.redhat.com/archives/fedora-package-announce/2009-September/msg00821.html
www.redhat.com/archives/fedora-package-announce/2009-September/msg00823.html
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:P/A:N
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
AI Score
Confidence
High
EPSS
Percentile
5.1%