Bug#542218: backuppc: Security hole when using rsync and multiple users

2009-10-05 Thread Marc Deslauriers
Included is a patch that moves the previous fix to a location before the settings get applied. Marc. diff -Naur backuppc-3.1.0.ori/lib/BackupPC/CGI/EditConfig.pm backuppc-3.1.0/lib/BackupPC/CGI/EditConfig.pm --- backuppc-3.1.0.ori/lib/BackupPC/CGI/EditConfig.pm 2009-10-05 08:04:01.0 -040

Bug#542218: backuppc: Security hole when using rsync and multiple users

2009-10-05 Thread Marc Deslauriers
The patch included in 3.1.0-7 doesn't actually fix the problem. Normal users can still set the ClientNameAlias by adding something like "&override_ClientNameAlias=1&v_zZ_ClientNameAlias=" to their POST. Marc. -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a sub

Bug#542218: backuppc: Security hole when using rsync and multiple users

2009-08-18 Thread David Ambrose-Griffith
Package: backuppc Version: 3.1.0-4 Severity: critical Tags: security Justification: root security hole When using an SSH key and Rsync with BackupPC on a system with multiple users, Users (as opposed to admins) have the ability to change the ClientNameAlias on machines they are listed as owning