CVE-2023-30577 – CVE-2023-30577 is an argument injection vulnera... (How to Fix)

Q: What is the severity of CVE-2023-30577?

CVE-2023-30577 has a CVSS score of 7.8 (HIGH). CVE-2023-30577 is an argument injection vulnerability in AMANDA's runtar.c component that allows attackers to execute arbitrary commands. This affects AMANDA backup systems running vulnerable versions, potentially compromising backup integrity and system security. Organizations using AMANDA for network backups are at risk.

📋 TL;DR

CVE-2023-30577 is an argument injection vulnerability in AMANDA's runtar.c component that allows attackers to execute arbitrary commands. This affects AMANDA backup systems running vulnerable versions, potentially compromising backup integrity and system security. Organizations using AMANDA for network backups are at risk.

💻 Affected Systems

Products:

AMANDA (Advanced Maryland Automatic Network Disk Archiver)

Versions: All versions before tag-community-3.5.4

Operating Systems: Linux, Unix-like systems

Default Config Vulnerable: ⚠️ Yes

Notes: Affects systems where AMANDA is installed and configured for backup operations. The vulnerability is in the runtar.c component used during backup processes.

📦 What is this software?

Amanda by Zmanda

View all CVEs affecting Amanda →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution with backup service privileges leading to full system compromise, data exfiltration, and lateral movement across the network.

🟠

Likely Case

Local privilege escalation or command injection allowing attackers to manipulate backup processes and access sensitive data.

🟢

If Mitigated

Limited impact with proper network segmentation and least privilege service accounts, potentially only affecting backup operations.

🌐 Internet-Facing: MEDIUM - While primarily a backup system, internet-exposed AMANDA instances could be targeted if misconfigured.

🏢 Internal Only: HIGH - Internal attackers or compromised systems could exploit this to escalate privileges and access sensitive backup data.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires some level of access to trigger the vulnerable argument checking in runtar.c. This is a different vulnerability from CVE-2022-37705.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: tag-community-3.5.4 and later

Vendor Advisory: https://github.com/zmanda/amanda/security/advisories/GHSA-crrw-v393-h5q3

Restart Required: Yes

Instructions:

1. Download AMANDA version tag-community-3.5.4 or later from GitHub releases. 2. Stop AMANDA services. 3. Install the updated version following distribution-specific package management or compilation instructions. 4. Restart AMANDA services.

🔧 Temporary Workarounds

Network Segmentation

all

Isolate AMANDA backup servers from critical systems and limit network access

Service Account Hardening

linux

Run AMANDA services with minimal privileges using dedicated service accounts

sudo useradd -r -s /bin/false amanda_user
sudo chown -R amanda_user:amanda_user /var/lib/amanda

🧯 If You Can't Patch

Implement strict network access controls to limit who can communicate with AMANDA services
Monitor AMANDA processes and logs for suspicious activity or unexpected command execution

🔍 How to Verify

Check if Vulnerable:

Check AMANDA version: amadmin version or check package version via distribution package manager

Check Version:

amadmin version 2>&1 | grep -i version || dpkg -l | grep amanda || rpm -qa | grep -i amanda

Verify Fix Applied:

Confirm version is tag-community-3.5.4 or later and review release notes for CVE-2023-30577 fix

📡 Detection & Monitoring

Log Indicators:

Unusual command execution in AMANDA logs
Errors or warnings related to runtar.c argument processing
Unexpected backup failures or anomalies

Network Indicators:

Unusual network connections from AMANDA servers
Suspicious outbound traffic patterns from backup systems

SIEM Query:

source="amanda.log" AND ("runtar" OR "argument" OR "injection") AND (error OR warning OR fail)

📊 Metadata

CVE ID: CVE-2023-30577

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-88

Published: July 26, 2023

Last Updated: November 4, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-30577, you might also want to check these: