CVE-2016-10729: Debian Linux

High severity, CVSS 7.8. EPSS: 1.3% chance of exploitation in the next 30 days.

An issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client installation. The "runtar" setuid root binary does not check for additional arguments supplied after --create, allowing users to manipulate commands and perform command injection as root.

Affected products

• Debian Debian Linux: version 7.0 only; version 8.0 only; version 9.0 only; version 10.0 only
• Red Hat Enterprise Linux: version 7.0 only
• Zmanda Amanda: version 3.3.1 only

Published 2018-10-24. Last modified 2026-06-17.