CVE-2020-11061: 
Bareos vulnerability analysis and mitigation

A heap overflow vulnerability was discovered in Bareos Director versions less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7. The vulnerability was assigned CVE-2020-11061 and was discovered on March 13, 2020, with public disclosure on July 9, 2020. The issue affects the Bareos backup software's director component (Bareos Advisory, NVD).

The vulnerability exists in the director component where a heap overflow can occur during the initialization of a verify job. The issue stems from the code not checking if the target buffer that scanf() writes into is large enough to fit the data, specifically when processing digest strings. The vulnerability has a CVSS v3.1 base score of 7.4 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L. The issue was identified in the fd_cmds.cc file, specifically around line 1119 (Bareos Bug).

The vulnerability allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. This could potentially lead to remote control over the director from a client, resulting in unauthorized access and potential system compromise (Bareos Advisory).

The vulnerability can be exploited by running a Verify job with level InitCatalog against a malicious file daemon that sends arbitrary length Digests. The attack requires network access and low privileges, but no user interaction (Bareos Bug).

The vulnerability was patched in Bareos versions 19.2.8, 18.2.9, and 17.2.10. The fix ensures the buffer is large enough by resizing it to the size of the message buffer being parsed. As a temporary workaround, users can disable verify jobs to mitigate the problem (Bareos Advisory).