Summary
Rsync Project heeft kwetsbaarheden verholpen in Rsync (versies <3.4.0).
Details
Interpretaties
De meest kritieke kwetsbaarheden in Rsync omvatten een heap-gebaseerde 'buffer overflow' (CVE-2024-12084) en een 'info leak' (CVE-2024-12085) die kunnen leiden tot willekeurige code-executie (aanwezig in Rsync-versies 3.2.7 & 3.3.0). Daarnaast zijn er kwetsbaarheden gerelateerd aan 'path traversal' en onjuiste verificatie van symbolische links, wat kan leiden tot ongeautoriseerde toegang tot gevoelige gegevens en het schrijven van bestanden buiten de bedoelde directory. Deze kwetsbaarheden kunnen worden misbruikt door aanvallers om de beschikbaarheid, integriteit en vertrouwelijkheid in gevaar te brengen.
Gezien de bekendheid van Rsync en de brede implementatie verwacht het NCSC op korte termijn PoC code.
Oplossingen
Rsync Project heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 6
-
Critical 9.8
Rsync: heap buffer overflow in rsync due to improper checksum length handling
A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of b…
-
High 7.5CVE-2024-12085 Public exploit
Rsync: info leak via uninitialized stack contents
A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitializ…
-
Medium 6.5
Rsync: path traversal vulnerability in rsync
A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--i…
-
Medium 6.5
Rsync: --safe-links option bypass leads to path traversal
A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may …
-
Medium 6.1
Rsync: rsync server leaks arbitrary client files
A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of …
-
Medium 5.6
Rsync: race condition in rsync handling symbolic links
A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the…
Revision history
-
#0
Initiele versie
References
-
Reference - ncscclear
https://www.kb.cert.org/vuls/id/952657
-
Reference - ncscclear
https://rsync.samba.org/ftp/rsync/NEWS.html#3.4.0
-
Reference - ncscclear
https://github.com/RsyncProject/rsync/releases/tag/v3.4.0