CVE-2020-4042: 
Bareos vulnerability analysis and mitigation

CVE-2020-4042 is a security vulnerability discovered in Bareos (Backup Archiving Recovery Open Sourced) software that affects versions 19.2.7 and earlier. The vulnerability was disclosed on July 9, 2020, and involves an authentication bypass in the director component when both client and director-initiated connections are allowed (Bareos Advisory).

The vulnerability allows a malicious client to communicate with the director without knowledge of the shared secret in specific configuration scenarios. The attack works when the director allows client-initiated connections and also connects to the client itself. The exploit method involves the malicious client replaying the Bareos director's cram-md5 challenge to the director, which causes the director to respond to the replayed challenge. The response obtained can then be used as a valid reply to the director's original challenge (Bareos Advisory).

When successfully exploited, this vulnerability enables unauthorized communication between a malicious client and the director without requiring knowledge of the shared secret. This bypass of authentication mechanisms could potentially lead to unauthorized access to backup systems and their data (Bareos Advisory).

The vulnerability is exploitable when specific conditions are met: the director must allow client-initiated connections while also being configured to connect to the client. The attack vector involves replay of authentication challenges, making it relatively straightforward to exploit in environments with this specific configuration (Bareos Advisory).

The vulnerability was patched in Bareos version 19.2.8. For users unable to upgrade immediately, a workaround exists: ensure the director will not connect to clients that can initiate connections. This can be achieved by setting 'Connection From Director To Client = no' for any client with 'Connection From Client To Director = yes'. The fix in version 19.2.8 implements checks to prevent replay attacks (Bareos Advisory).