EulerOS Virtualization 2.11.1 : rsync (EulerOS-SA-2026-3470)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(347181);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/18");

  script_cve_id(
    "CVE-2024-12085",
    "CVE-2024-12086",
    "CVE-2024-12087",
    "CVE-2024-12088",
    "CVE-2024-12747",
    "CVE-2025-10158",
    "CVE-2026-43617",
    "CVE-2026-43618",
    "CVE-2026-43620",
    "CVE-2026-45232"
  );
  script_xref(name:"IAVA", value:"2026-A-0502");

  script_name(english:"EulerOS Virtualization 2.11.1 : rsync (EulerOS-SA-2026-3470)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS Virtualization host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the rsync packages installed, the EulerOS Virtualization installation on the remote host is
affected by the following vulnerabilities :

    A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify
    if a symbolic link destination sent from the server contains another symbolic link within it. This results
    in a path traversal vulnerability, which may lead to arbitrary file write outside the desired
    directory.(CVE-2024-12088)

    A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive`
    option, a default-enabled option for many client options and can be enabled by the server even if not
    explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink
    verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to
    write files outside of the client's intended destination directory. A malicious server could write
    malicious files to arbitrary locations named after valid directories/paths on the client.(CVE-2024-12087)

    A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the
    client's machine. This issue occurs when files are being copied from a client to a server. During this
    process, the rsync server will send checksums of local data to the client to compare with in order to
    determine what data needs to be sent to the server. By sending specially constructed checksum values for
    arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the
    responses from the client.(CVE-2024-12086)

    A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an
    attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and
    uninitialized memory and leak one byte of uninitialized stack data at a time.(CVE-2024-12085)

    A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of
    symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker
    replaced a regular file with a symbolic link at the right time, it was possible to bypass the default
    behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could
    leak sensitive information, potentially leading to privilege escalation.(CVE-2024-12747)

    A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a
    heap based buffer, via a negative array index. The malicious rsync client requires at least read access to
    the remote rsync module in order to trigger the issue.(CVE-2025-10158)

    Rsync version  3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's
    hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-
    based deny rules by controlling the PTR record for their source IP address, allowing connections from
    hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to
    UNKNOWN.(CVE-2026-43617)

    Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder
    where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an
    overflow that causes the receiver process to read and return data from outside the intended buffer bounds.
    Attackers can exploit this vulnerability to disclose process memory contents including environment
    variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR
    effectiveness and facilitating further exploitation.(CVE-2026-43618)

    Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the
    establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by
    sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the
    client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a
    newline terminator, causing a null byte to be written to an out-of-bounds stack address when the
    RSYNC_PROXY environment variable is set.(CVE-2026-45232)

    Rsync version  3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in
    recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process.
    Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a
    specially crafted file list where the first sorted entry is not the leading dot directory, followed by a
    transfer record with ndx=0 and an iflag word without ITEM_TRANSFER, causing the receiver to read 8 bytes
    before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in
    a deterministic SIGSEGV crash of the rsync client.(CVE-2026-43620)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization rsync security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-3470
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?07976ef3");
  script_set_attribute(attribute:"solution", value:
"Update the affected rsync packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-12088");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-43620");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/01/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rsync");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rsync-help");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:uvp:2.11.1");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (uvp != "2.11.1") audit(AUDIT_OS_NOT, "EulerOS Virtualization 2.11.1");
if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("aarch64" >!< cpu) audit(AUDIT_ARCH_NOT, "aarch64", cpu);

var flag = 0;

var pkgs = [
  "rsync-3.2.3-2.h12.eulerosv2r11",
  "rsync-help-3.2.3-2.h12.eulerosv2r11"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "rsync");
}