CVE-2009-3369 - Vulnerability Details - OpenCVE

CgiUserConfigEdit in BackupPC 3.1.0, when SSH keys and Rsync are in use in a multi-user environment, does not restrict users from the ClientNameAlias function, which allows remote authenticated users to read and write sensitive files by modifying ClientNameAlias to match another system, then initiating a backup or restore.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

The EPSS score is 0.0443.

Key SSVC decision points have not yet been added.

Vendors	Products
Backuppc	Backuppc

Configuration 1 [-]

cpe:2.3:a:backuppc:backuppc:3.1.0:*:*:*:*:*:*:*

No data.

No data.

References

Link	Providers
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=542218
http://osvdb.org/57236
http://secunia.com/advisories/36393
http://secunia.com/advisories/37161
https://bugzilla.redhat.com/show_bug.cgi?id=518412
https://www.cve.org/CVERecord?id=CVE-2009-3369
https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00694.html
https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00729.html

History

Mon, 08 Sep 2025 17:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Backuppc Backuppc backuppc
CPEs	cpe:2.3:a:craig_barratt:backuppc:3.1.0:::::::*	cpe:2.3:a:backuppc:backuppc:3.1.0:::::::*
Vendors & Products	Craig Barratt Craig Barratt backuppc	Backuppc Backuppc backuppc

Wed, 28 May 2025 14:45:00 +0000

Type	Values Removed	Values Added
References		https://www.cve.org/CVERecord?id=CVE-2009-3369

Thu, 22 May 2025 04:30:00 +0000

Type	Values Removed	Values Added
References	https://nvd.nist.gov/vuln/detail/CVE-2009-3369 https://www.cve.org/CVERecord?id=CVE-2009-3369

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2009-09-24T16:00:00

Updated: 2024-08-07T06:22:24.458Z

Reserved: 2009-09-24T00:00:00

Link: CVE-2009-3369

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2009-09-24T16:30:02.407

Modified: 2025-09-08T16:54:12.430

Link: CVE-2009-3369

Redhat

Severity : Low

Publid Date: 2009-08-18T00:00:00Z

Links: CVE-2009-3369 - Bugzilla

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2009-08-18T00:00:00", "descriptions": [{"lang": "en", "value": "CgiUserConfigEdit in BackupPC 3.1.0, when SSH keys and Rsync are in use in a multi-user environment, does not restrict users from the ClientNameAlias function, which allows remote authenticated users to read and write sensitive files by modifying ClientNameAlias to match another system, then initiating a backup or restore."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2009-10-31T09:00:00", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=518412"}, {"name": "36393", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/36393"}, {"tags": ["x_refsource_MISC"], "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=542218"}, {"name": "FEDORA-2009-9973", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00729.html"}, {"name": "FEDORA-2009-9982", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00694.html"}, {"name": "37161", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/37161"}, {"name": "57236", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/57236"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2009-3369", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "CgiUserConfigEdit in BackupPC 3.1.0, when SSH keys and Rsync are in use in a multi-user environment, does not restrict users from the ClientNameAlias function, which allows remote authenticated users to read and write sensitive files by modifying ClientNameAlias to match another system, then initiating a backup or restore."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://bugzilla.redhat.com/show_bug.cgi?id=518412", "refsource": "CONFIRM", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=518412"}, {"name": "36393", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/36393"}, {"name": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=542218", "refsource": "MISC", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=542218"}, {"name": "FEDORA-2009-9973", "refsource": "FEDORA", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00729.html"}, {"name": "FEDORA-2009-9982", "refsource": "FEDORA", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00694.html"}, {"name": "37161", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/37161"}, {"name": "57236", "refsource": "OSVDB", "url": "http://osvdb.org/57236"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T06:22:24.458Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=518412"}, {"name": "36393", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/36393"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=542218"}, {"name": "FEDORA-2009-9973", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00729.html"}, {"name": "FEDORA-2009-9982", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00694.html"}, {"name": "37161", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/37161"}, {"name": "57236", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/57236"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2009-3369", "datePublished": "2009-09-24T16:00:00", "dateReserved": "2009-09-24T00:00:00", "dateUpdated": "2024-08-07T06:22:24.458Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:backuppc:backuppc:3.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "0509FE0E-E483-4A6B-9653-F1DBDA321DA5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CgiUserConfigEdit in BackupPC 3.1.0, when SSH keys and Rsync are in use in a multi-user environment, does not restrict users from the ClientNameAlias function, which allows remote authenticated users to read and write sensitive files by modifying ClientNameAlias to match another system, then initiating a backup or restore."}, {"lang": "es", "value": "CgiUserConfigEdit en BackupP v3.1.0, cuando las claves SSH y Rsync est\u00e1n en uso en un entorno multiusuario, no limita el acceso a los usuarios desde la funci\u00f3n CLientNameAlias, lo que permite a usuarios autenticados remotamente la lectura y escritura de archivos sensibles mediante la modificaci\u00f3n de ClientNameAlias para que coincida con el de otro sustema, y despu\u00e9s iniciando una copia de seguridad o restaur\u00e1ndola."}], "id": "CVE-2009-3369", "lastModified": "2025-09-08T16:54:12.430", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "COMPLETE", "baseScore": 8.5, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 10.0, "obtainAllPrivilege": true, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2009-09-24T16:30:02.407", "references": [{"source": "cve@mitre.org", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=542218"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/57236"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/36393"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/37161"}, {"source": "cve@mitre.org", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=518412"}, {"source": "cve@mitre.org", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00694.html"}, {"source": "cve@mitre.org", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00729.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=542218"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/57236"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/36393"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/37161"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=518412"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00694.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00729.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}