Ubuntu 18.04 LTS / 20.04 LTS : rsync vulnerability (USN-5359-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-5359-1 advisory. Danilo Ramos discovered that rsync incorrectly handled memory when performing certain zlib deflating operations. An attacker could use this issue to...

A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity. This flaw affects rsync versions before 3.2.4.

...

PocCollect

This is a Python-based proof-of-concept POC collection repository. The repository contains a variety of POCs for different vulnerabilities, including Struts2, Heartbleed, and Java Deserialization. The POCs are designed to be used for educational purposes only and should not be used for malicious...

Unspecified vulnerability in Rsync rsync-ssl

Rsync is a suite of data mirroring backup applications for Unix-like systems. A security vulnerability exists in Rsync's rsync-ssl, which can be exploited by an attacker to compromise confidentiality and integrity...

CVE-2020-14387

A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise...

The vulnerability of the rsync command processor in the RSSH command interface, due to insufficient input validation, allows a malicious actor to execute arbitrary commands.

The vulnerability of the rsync command processor in the RSSH command shell is related to errors in input data validation. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands...

The vulnerability of the “rsync” implementation in the rssh command interface allows a hacker to execute arbitrary commands on the rssh interface.

The vulnerability of the “rsync” command in the rssh command interface is related to insufficient cleaning of the arguments passed to the command. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands on the rssh interface...

PT-2018-1905 · Rsync +3 · Rsync +3

Name of the Vulnerable Software and Affected Versions: rsync versions prior to 3.1.3 Description: The issue is related to the parse arguments function in options.c in rsyncd, which does not prevent multiple uses of the --protect-args parameter. This allows remote attackers to bypass an...

MGASA-2017-0452 Updated rsync package fixes security vulnerabilities

The recvfiles function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the daemonfilterlist data structure, which allows remote attackers to bypass intended access restrictions...

USN-3506-1 rsync vulnerabilities

It was discovered that rsync proceeds with certain file metadata updates before checking for a filename. An attacker could use this to bypass access restrictions. CVE-2017-17433 It was discovered that rsync does not check for fnamecmp filenames and also does not apply the sanitizepaths protection...

ALPINE-CVE-2017-17433

The recvfiles function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the daemonfilterlist data structure, which allows remote attackers to bypass intended access restrictions...

rsync access restriction bypass vulnerability (CNVD-2018-00212)

rsync is a data mirroring backup application for Unix-like systems developed by Australian software developers Andrew Tridgell and Paul Mackerras that synchronizes file and directory updates between two computers and uses differential encoding to reduce data transfers. A security vulnerability in...

rsync denial of service vulnerability

rsync is a data mirroring backup application for Unix-like systems developed by Australian software developers Andrew Tridgell and Paul Mackerras that synchronizes file and directory updates between two computers and uses differential encoding to reduce data transfers. A security vulnerability...

CVE-2017-16548

The receivexattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, which allows remote attackers to cause a denial of service heap-based buffer over-read and application crash or possibly have unspecified other impact by sendi...

rsync security bypass vulnerability

rsync is a data mirroring backup application for Unix-like systems developed by Australian software developers Andrew Tridgell and Paul Mackerras that synchronizes file and directory updates between two computers and uses differential encoding to reduce data transfers. A security bypass...

CVE-2017-15994

rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to bypass intended access restrictions. NOTE: the rsync development branch has significant use beyond the rsync developers, e.g., the code has been copied for use in various GitHub...

Ubuntu 14.04 LTS : rsync vulnerability (USN-2879-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2879-1 advisory. It was discovered that rsync incorrectly handled invalid filenames. A malicious server could use this issue to write files outside of the intended destination...

The vulnerability of the Gentoo Linux operating system allows a malicious intruder to compromise the confidentiality and integrity of protected information.

The vulnerability of the rsync package up to version 2.6.0-r2 inclusive in the Gentoo Linux operating system can lead to violations of confidentiality and integrity of protected information. This vulnerability can be exploited remotely...

The vulnerability of the Gentoo Linux operating system allows a malicious intruder to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the rsync package up to version 2.6.8 in the Gentoo Linux operating system can lead to violations of confidentiality, integrity, and accessibility of protected information. This vulnerability can be exploited remotely...

The vulnerability of the Red Hat Enterprise Linux operating system allows a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the rsync-3.0.6 package for the Red Hat Enterprise Linux operating system can lead to violations of confidentiality, integrity, and accessibility of protected information. This vulnerability can be exploited remotely...