Summary
It was discovered that rsync proceeds with certain file metadata updates
before checking for a filename. An attacker could use this to bypass access
restrictions. (CVE-2017-17433)
It was discovered that rsync does not check for fnamecmp filenames and also
does not apply the sanitize_paths protection mechanism to pathnames. An attacker
could use this to bypass access restrictions. (CVE-2017-17434)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | rsync | 3.1.0-2ubuntu0.3 |
| Ubuntu · 16.04 LTS 16.04:LTS | rsync | 3.1.1-3ubuntu1.1 |
Vulnerabilities 2
-
Unscored —
The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds w…
-
Unscored —
The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon…