3621 matches found
Debian DSA-538-1 : rsync - unsanitised input processing
The rsync developers have discovered a security related problem in rsync, a fast remote file copy program, which offers an attacker to access files outside of the defined directory. To exploit this path-sanitizing bug, rsync has to run in daemon mode with the chroot option being disabled. It does...
Debian DSA-106-2 : rsync - remote exploit
Sebastian Krahmer found several places in rsync a popular tool to synchronise files between machines where signed and unsigned numbers were mixed which resulted in insecure code see securityfocus.com. This could be abused by remote users to write 0-bytes in rsync's memory and trick rsync into...
Debian DSA-404-1 : rsync - heap overflow
The rsync team has received evidence that a vulnerability in all versions of rsync prior to 2.5.7, a fast remote file copy program, was recently used in combination with a Linux kernel vulnerability to compromise the security of a public rsync server. While this heap overflow vulnerability could...
Mac OS X Multiple Vulnerabilities (Security Update 2004-09-07)
The remote host is missing Security Update 2004-09-07. This security update fixes the following components : - CoreFoundation - IPSec - Kerberos - libpcap - lukemftpd - NetworkConfig - OpenLDAP - OpenSSH - PPPDialer - rsync - Safari - tcpdump These applications contain multiple vulnerabilities th...
security flaw
Directory traversal vulnerability in the sanitizepath function in util.c for rsync 2.6.2 and earlier, when chroot is disabled, allows attackers to read or write certain files...
Moderate: Red Hat Security Advisory: rsync security update
An updated rsync package that fixes a path sanitizing bug is now available. The rsync program synchronizes files over a network. Versions of rsync up to and including version 2.6.2 contain a path sanitization issue. This issue could allow an attacker to read or write files outside of the rsync...
RHEL 2.1 / 3 : rsync (RHSA-2004:436)
An updated rsync package that fixes a path sanitizing bug is now available. The rsync program synchronizes files over a network. Versions of rsync up to and including version 2.6.2 contain a path sanitization issue. This issue could allow an attacker to read or write files outside of the rsync...
GLSA-200408-17 : rsync: Potential information leakage
The remote host is affected by the vulnerability described in GLSA-200408-17 rsync: Potential information leakage The paths sent by the rsync client are not checked thoroughly enough. It does not affect the normal send/receive filenames that specify what files should be transferred. It does affec...
GLSA-200407-10 : rsync: Directory traversal in rsync daemon
The remote host is affected by the vulnerability described in GLSA-200407-10 rsync: Directory traversal in rsync daemon When rsyncd is used without chroot 'use chroot = false' in the rsyncd.conf file, the paths sent by the client are not checked thoroughly enough. If rsyncd is used with read-writ...
FreeBSD Ports : rsync < 2.6.2_2
The remote host has an old version of rsync installed. There is a flaw in this version of rsync which, due to an input validation error, would allow a remote attacker to gain access to the remote system. An attacker, exploiting this flaw, would need network access to the TCP port. Successful...
Mandrake Linux Security Advisory : rsync (MDKSA-2004:083)
An advisory was sent out by the rsync team regarding a security vulnerability in all versions of rsync prior to and including 2.6.2. If rsync is running in daemon mode, and not in a chrooted environment, it is possible for a remote attacker to trick rsyncd into creating an absolute pathname while...
Rsync < 2.6.3 Sanitize_path Function Module Path Escaping
Binary data 1965.prm...
rsync Detection
Binary data 1896.prm...
rsync < 2.6.1 Traversal Arbitrary File Creation
Binary data 1216.prm...
rsync < 2.5.2 Signedness Error Array Overflow
Binary data 1897.prm...
Fedora Core 2 : rsync-2.6.2-1.fc2.0 (2004-269)
This update backports a security fix to a path-sanitizing flaw that affects rsync when it is used in daemon mode without also using chroot. For more information see http://samba.org/rsync/securityaug04 Note that Tenable Network Security has extracted the preceding description block directly from...
Fedora Core 1 : rsync-2.5.7-5.fc1.1 (2004-268)
This update backports a security fix to a path-sanitizing flaw that affects rsync when it is used in daemon mode without also using chroot. For more information see http://samba.org/rsync/securityaug04 Note that Tenable Network Security has extracted the preceding description block directly from...
CVE-2004-0792
CVE-2004-0792 describes a directory traversal in rsync 2.6.2 and earlier, via the sanitize_path function in util.c, when chroot is disabled. The vulnerability allows reading or writing certain files. Exploitation details are not provided in the documents beyond this description, and no remediatio...
