rsync: remote arbitrary files write inside the directories of connecting peers

A flaw was found in rsync that is triggered by a victim rsync user/client connecting to a malicious rsync server. The server can copy and overwrite arbitrary files in the client's rsync target directory and subdirectories. This flaw allows a malicious server, or in some cases, another attacker wh...

rsync: remote arbitrary files write inside the directories of connecting peers

A flaw was found in rsync that is triggered by a victim rsync user/client connecting to a malicious rsync server. The server can copy and overwrite arbitrary files in the client's rsync target directory and subdirectories. This flaw allows a malicious server, or in some cases, another attacker wh...

SUSE SLES12 Security Update : rsync (SUSE-SU-2022:2859-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2022:2859-1 advisory. - CVE-2022-29154: Fixed an arbitrary file write issue that could be triggered by a malicious remote server bsc1201840. Tenable has extracted...

USN-5573-1 rsync vulnerability

Evgeny Legerov discovered that zlib incorrectly handled memory when performing certain inflate operations. An attacker could use this issue to cause rsync to crash, resulting in a denial of service, or possibly execute arbitrary code...

CLSA-2022-1660759162 Fixed CVE-2022-29154 in rsync

CVE-2022-29154: fix arbitrary file write vulnerability via malicious rysnc server MITM attack - Add '%check unset DISPLAY ' section but disable broken 'daemon' and 'hardlinks' tests...

ALPINE-CVE-2022-29154

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A...

CVE-2022-29154

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A...

rsync 输入验证错误漏洞

rsync is an open source utility program by Wayne Davison, an individual developer, that provides fast incremental file transfers. A security vulnerability exists in versions prior to rsync 3.2.5 that stems from insufficient validation of filenames by the rsync client...

USN-5359-2 rsync vulnerability

USN-5359-1 fixed vulnerabilities in rsync. This update provides the corresponding updates for Ubuntu 16.04 ESM. Original advisory details: Danilo Ramos discovered that rsync incorrectly handled memory when performing certain zlib deflating operations. An attacker could use this issue to cause rsy...

Ubuntu 16.04 ESM : rsync vulnerability (USN-5359-2)

The remote Ubuntu 16.04 ESM host has a package installed that is affected by a vulnerability as referenced in the USN-5359-2 advisory. USN-5359-1 fixed vulnerabilities in rsync. This update provides the corresponding updates for Ubuntu 16.04 ESM. Tenable has extracted the preceding description...

Ubuntu 18.04 LTS / 20.04 LTS : rsync vulnerability (USN-5359-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-5359-1 advisory. Danilo Ramos discovered that rsync incorrectly handled memory when performing certain zlib deflating operations. An attacker could use this issue to...

A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity. This flaw affects rsync versions before 3.2.4.

...

PocCollect

This is a Python-based proof-of-concept POC collection repository. The repository contains a variety of POCs for different vulnerabilities, including Struts2, Heartbleed, and Java Deserialization. The POCs are designed to be used for educational purposes only and should not be used for malicious...

Unspecified vulnerability in Rsync rsync-ssl

Rsync is a suite of data mirroring backup applications for Unix-like systems. A security vulnerability exists in Rsync's rsync-ssl, which can be exploited by an attacker to compromise confidentiality and integrity...

CVE-2020-14387

A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise...

The vulnerability of the rsync command processor in the RSSH command interface, due to insufficient input validation, allows a malicious actor to execute arbitrary commands.

The vulnerability of the rsync command processor in the RSSH command shell is related to errors in input data validation. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands...

The vulnerability of the “rsync” implementation in the rssh command interface allows a hacker to execute arbitrary commands on the rssh interface.

The vulnerability of the “rsync” command in the rssh command interface is related to insufficient cleaning of the arguments passed to the command. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands on the rssh interface...

PT-2018-1905 · Rsync +3 · Rsync +3

Name of the Vulnerable Software and Affected Versions: rsync versions prior to 3.1.3 Description: The issue is related to the parse arguments function in options.c in rsyncd, which does not prevent multiple uses of the --protect-args parameter. This allows remote attackers to bypass an...

MGASA-2017-0452 Updated rsync package fixes security vulnerabilities

The recvfiles function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the daemonfilterlist data structure, which allows remote attackers to bypass intended access restrictions...

USN-3506-1 rsync vulnerabilities

It was discovered that rsync proceeds with certain file metadata updates before checking for a filename. An attacker could use this to bypass access restrictions. CVE-2017-17433 It was discovered that rsync does not check for fnamecmp filenames and also does not apply the sanitizepaths protection...