This CPE summary could be partial or incomplete. Please contact us for a detailed listing.
Summary
| Detail | |||
|---|---|---|---|
| Vendor | Bacula | First view | 2005-09-20 |
| Product | Bacula | Last view | 2012-10-10 |
| Version | * | Type | Application |
| Update | * | ||
| Edition | * | ||
| Language | * | ||
| Sofware Edition | * | ||
| Target Software | * | ||
| Target Hardware | * | ||
| Other | * | ||
| CPE Product | cpe:2.3:a:bacula:bacula | ||
Activity : Overall
Related : CVE
| Date | Alert | Description | |
|---|---|---|---|
| 4 | 2012-10-10 | CVE-2012-4430 | The dump_resource function in dird/dird_conf.c in Bacula before 5.2.11 does not properly enforce ACL rules, which allows remote authenticated users to obtain resource dump information via unspecified vectors. |
| 2.1 | 2007-10-23 | CVE-2007-5626 | make_catalog_backup in Bacula 2.2.5, and probably earlier, sends a MySQL password as a command line argument, and sometimes transmits cleartext e-mail containing this command line, which allows context-dependent attackers to obtain the password by listing the process and its arguments, or by sniffing the network. |
| 3.6 | 2005-09-20 | CVE-2005-2995 | bacula 1.36.3 and earlier allows local users to modify or read sensitive files via symlink attacks on (1) the temporary file used by autoconf/randpass when openssl is not available, or (2) the mtx.[PID] temporary file in mtx-changer.in. |
CWE : Common Weakness Enumeration
| % | id | Name |
|---|---|---|
| 50% (1) | CWE-310 | Cryptographic Issues |
| 50% (1) | CWE-264 | Permissions, Privileges, and Access Controls |
CAPEC : Common Attack Pattern Enumeration & Classification
| id | Name |
|---|---|
| CAPEC-31 | Accessing/Intercepting/Modifying HTTP Cookies |
| CAPEC-37 | Lifting Data Embedded in Client Distributions |
| CAPEC-65 | Passively Sniff and Capture Application Code Bound for Authorized Client |
| CAPEC-102 | Session Sidejacking |
| CAPEC-117 | Data Interception Attacks |
| CAPEC-155 | Screen Temporary Files for Sensitive Information |
| CAPEC-157 | Sniffing Attacks |
| CAPEC-167 | Lifting Sensitive Data from the Client |
| CAPEC-204 | Lifting cached, sensitive data embedded in client distributions (thick or thin) |
| CAPEC-205 | Lifting credential(s)/key material embedded in client distributions (thick or... |
| CAPEC-258 | Passively Sniffing and Capturing Application Code Bound for an Authorized Cli... |
| CAPEC-259 | Passively Sniffing and Capturing Application Code Bound for an Authorized Cli... |
| CAPEC-260 | Passively Sniffing and Capturing Application Code Bound for an Authorized Cli... |
Open Source Vulnerability Database (OSVDB)
| id | Description |
|---|---|
| 41861 | Bacula make_catalog_backup Function MySQL Director Password Cleartext Disclosure |
| 19514 | Bacula /scripts/mtx-changer.in Insecure Temporary File Creation |
| 19512 | Bacula /autoconf/randpass Insecure Temporary File Creation |
OpenVAS Exploits
| id | Description |
|---|---|
| 2012-10-13 | Name : Debian Security Advisory DSA 2558-1 (bacula) File : nvt/deb_2558_1.nasl |
| 2012-09-15 | Name : FreeBSD Ports: bacula File : nvt/freebsd_bacula.nasl |
| 2012-08-30 | Name : Fedora Update for bacula FEDORA-2012-11717 File : nvt/gb_fedora_2012_11717_bacula_fc17.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200807-10 (bacula) File : nvt/glsa_200807_10.nasl |
Nessus® Vulnerability Scanner
| id | Description |
|---|---|
| 2014-05-19 | Name: The remote Gentoo host is missing one or more security-related patches. File: gentoo_GLSA-201405-11.nasl - Type: ACT_GATHER_INFO |
| 2013-01-25 | Name: The remote Fedora host is missing a security update. File: fedora_2012-14452.nasl - Type: ACT_GATHER_INFO |
| 2012-10-09 | Name: The remote Debian host is missing a security-related update. File: debian_DSA-2558.nasl - Type: ACT_GATHER_INFO |
| 2012-09-15 | Name: The remote FreeBSD host is missing a security-related update. File: freebsd_pkg_143f6932fedb11e1ad4a003067b2972c.nasl - Type: ACT_GATHER_INFO |
| 2012-08-27 | Name: The remote Fedora host is missing a security update. File: fedora_2012-11717.nasl - Type: ACT_GATHER_INFO |
| 2008-07-23 | Name: The remote Gentoo host is missing one or more security-related patches. File: gentoo_GLSA-200807-10.nasl - Type: ACT_GATHER_INFO |
