CVE-2009-3102

CRITICAL 10.0CVE-2009-3102 · Published 08/09/2009 · updated 16/06/2026

In short

CVE-2009-3102 is a CRITICAL (CVSS 10.0) vulnerability affecting zrm for my sql (zmanda).
Chance of exploitation in the next 30 days (EPSS): 3.3%, higher than 88.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
zrm for my sql zmanda	`= 2.1`	No fix yet

Description

The doHotCopy subroutine in socket-server.pl in Zmanda Recovery Manager (ZRM) for MySQL 2.x before 2.1.1 allows remote attackers to execute arbitrary commands via vectors involving a crafted $MYSQL_BINPATH variable.

References

forums.zmanda.com/showthread.php
secunia.com/advisories/36424 · Vendor Advisory
secunia.com/advisories/36429 · Vendor Advisory
twitter.com/elegerov/statuses/3518763099
twitter.com/elegerov/statuses/3547652507
intevydis.com/blog
exchange.xforce.ibmcloud.com/vulnerabilities/52977
exchange.xforce.ibmcloud.com/vulnerabilities/52978

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free