CVE-2009-3611

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-10-26 · updated 2026-06-16
Weakness: CWE-732

Description

common/snapshots.py in Back In Time (aka backintime) 0.9.26 changes certain permissions to 0777 before deleting the files in an old backup snapshot, which allows local users to obtain sensitive information by reading these files, or interfere with backup integrity by modifying files that are shared across snapshots.

Affected products

Fedoraproject Fedora: 10, 11
Le-Web Backintime: 0.9.26

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=543785
http://bugs.gentoo.org/show_bug.cgi?id=289047
http://ftp.debian.org/debian/pool/main/b/backintime/backintime_0.9.26-3.diff.gz
http://marc.info/?l=oss-security&m=125553645511436&w=2
http://marc.info/?l=oss-security&m=125554894700336&w=2
https://bugs.launchpad.net/ubuntu/+source/backintime/+bug/434256
https://bugzilla.redhat.com/show_bug.cgi?id=520210
https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00821.html
https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00823.html
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=543785
http://bugs.gentoo.org/show_bug.cgi?id=289047
http://ftp.debian.org/debian/pool/main/b/backintime/backintime_0.9.26-3.diff.gz

Get alerted when CVE-2009-3611 or the next vulnerability affects your stack