Security fixes for rdiff-backup v2.2

Release Announcements
1

An important security fix is now available for minarca-server. This new version v2.2.6-13 include a backported patch to fix an important vulnerability in rdiff-backup server.

This was reported by Jeff Tong https://github.com/Wind010.

The CVE is not yet available, but it’s on the way.

Here a short summary:

  1. What: rdiff-backup --server (v2.2.6) calls pickle.loads() on attacker-controlled data, with no restrictions on what can be deserialized.
  2. Exploit: Anyone who can write to the server’s stdin can send a crafted frame containing a pickle payload (via __reduce__) and run arbitrary code as the server’s user.
  3. Impact: Mainly local privilege escalation to root where --server is allowed through. It would be remote code execution if the pipe were reachable across a trust boundary.

For minarca-server, this is limited to a local privilege escalation to minarca user (not root) because to addition sandboxing implemented directly in minarca-server, exactly to mitigate this kind of vulnerability.