CVE-2017-17433

2017-12-0500:00:00

ubuntu.com

3.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.004 Low

EPSS

Percentile

72.7%

JSON

The recv_files function in receiver.c in the daemon in rsync 3.1.2, and
3.1.3-development before 2017-12-03, proceeds with certain file metadata
updates before checking for a filename in the daemon_filter_list data
structure, which allows remote attackers to bypass intended access
restrictions.

Bugs

<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=883667>

OSVersionArchitecturePackageVersionFilename
ubuntu17.10noarchrsync< 3.1.2-2ubuntu0.1UNKNOWN
ubuntu14.04noarchrsync< 3.1.0-2ubuntu0.3UNKNOWN
ubuntu16.04noarchrsync< 3.1.1-3ubuntu1.1UNKNOWN
ubuntu17.04noarchrsync< 3.1.2-1ubuntu0.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	17.10	noarch	rsync	< 3.1.2-2ubuntu0.1	UNKNOWN
ubuntu	14.04	noarch	rsync	< 3.1.0-2ubuntu0.3	UNKNOWN
ubuntu	16.04	noarch	rsync	< 3.1.1-3ubuntu1.1	UNKNOWN
ubuntu	17.04	noarch	rsync	< 3.1.2-1ubuntu0.1	UNKNOWN