USN-3506-1: rsync vulnerabilities

It was discovered that rsync proceeds with certain file metadata updates before checking for a filename. An attacker could use this to bypass access restrictions. CVE-2017-17433 It was discovered that rsync does not check for fnamecmp filenames and also does not apply the sanitizepaths protection...

CVE-2017-17434

The CVE-2017-17434 issue affects rsync 3.1.2 and 3.1.3-development prior to 2017-12-03. The daemon can bypass access restrictions by not checking fnamecmp filenames in daemon_filter_list and by not applying sanitize_paths to pathnames in "xname follows" strings (read_ndx_and_attrs in rsync.c). Re...

UBUNTU-CVE-2017-17434

The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemonfilterlist data structure in the recvfiles function in receiver.c and also does not apply the sanitizepaths protection mechanism to pathnames found in "xname follows" strings in...