"Flexible backup tool for small to medium sized installations. Flexbackup is a flexible backup tool that works well for small to medium sized tasks for which solutions like amanda are overkill."
Lack of random temporary file name by flexbackup, allows local attackers to execute arbitrary programs with the privileges of other users of the flexbackup program.
Vulnerable Systems:
* flexbackup version 1.2.1 and prior
flexbackup is vulnerable to symlink attacks allowing local attackers to create arbitrary files with the privileges of the user running the affected script. This in turn could cause information disclosure, possible local or even remote arbitrary commands execution.
Vulnerable Code:
* In /etc/flexbackup.conf :
$tmpdir = '/tmp';
* Into flexbackup :
&checkvar(\$cfg::tmpdir,'tmpdir','exist','/tmp');
If tmpdir is not defined /tmp is used by default, but here into conf file tmpdir is by default set to /tmp
5229 my $tmp_script = "$cfg::tmpdir/buftest.$host.$PROCESS_ID.sh";
A possible symlink attack (race condition) exists on this code that is also possible to create a untrusted script into the tmp_script (race condition).
The script how is created is also vulnerable to possible symlink attack (race condition).
Untrusted script could be executed on localhost or remote host.
5446 my $tmp1 = "$cfg::tmpdir/test1.$PROCESS_ID";
5447 my $tmp2 = "$cfg::tmpdir/test2.$PROCESS_ID";
5448 my $tmp3 = "$cfg::tmpdir/test3.$PROCESS_ID";
Here the $cfg::pad_blocks should be false to exploit the possible symlink attack (race condition). By default in the conf file pad_blocks is true. No risk if no configuration modification.
