rsync before 2.6.1 does not properly sanitize paths when running a read/write daemon without using chroot, which allows remote attackers to write files outside of the module's path.

When running rsync in daemon mode, no checks were made to prevent clients from writing outside of a module's `path' setting.

New rsync packages are available for Slackware 8.1, 9.0, 9.1, and
-current to fix a security issue. When running an rsync server without the chroot option it is possible for an attacker to write outside of the allowed directory. Any sites running rsync in that mode should upgrade right away (and should probably look into using the chroot option as well).

A vulnerability was discovered in rsync, a file transfer program, whereby a remote user could cause an rsync daemon to write files outside of the intended directory tree. This vulnerability is not exploitable when the daemon is configured with the 'chroot' option.

The remote host is missing Security Update 2004-09-07.  This security update fixes the following components :

  - CoreFoundation
  - IPSec
  - Kerberos
  - libpcap
  - lukemftpd
  - NetworkConfig
  - OpenLDAP
  - OpenSSH
  - PPPDialer
  - rsync
  - Safari
  - tcpdump

These applications contain multiple vulnerabilities that may allow a remote attacker to execute arbitrary code.

The remote host is affected by the vulnerability described in GLSA-200407-10 (rsync: Directory traversal in rsync daemon)

    When rsyncd is used without chroot ('use chroot = false' in the rsyncd.conf     file), the paths sent by the client are not checked thoroughly enough. If     rsyncd is used with read-write permissions ('read only = false'), this     vulnerability can be used to write files anywhere with the rights of the     rsyncd daemon. With default Gentoo installations, rsyncd runs in a chroot,     without write permissions and with the rights of the 'nobody' user.
  Impact :

    On affected configurations and if the rsync daemon runs under a privileged     user, a remote client can exploit this vulnerability to completely     compromise the host.
  Workaround :

    You should never set the rsync daemon to run with 'use chroot = false'. If     for some reason you have to run rsyncd without a chroot, then you should     not set 'read only = false'.

The remote rsync server may be vulnerable to a path traversal issue.
 An attacker may use this flaw to create arbitrary files hosted outside of a module directory.

Rsync before 2.6.1 does not properly sanitize paths when running a read/write daemon without using chroot, allows remote attackers to write files outside of the module's path.

The updated packages provide a patched rsync to correct this problem.

Rsync before 2.6.1 does not properly sanitize paths when running a read/write daemon without using chroot. This could allow a remote attacker to write files outside of the module's 'path', depending on the privileges assigned to the rsync daemon. Users not running an rsync daemon, running a read-only daemon, or running a chrooted daemon are not affected by this issue. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0426 to this issue.

Updated packages were made available in June 2004 however the original update notification email did not make it to fedora-announce-list at that time.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An updated rsync package that fixes a directory traversal security flaw is now available.

Rsync is a program for synchronizing files over a network.

Rsync before 2.6.1 does not properly sanitize paths when running a read/write daemon without using chroot. This could allow a remote attacker to write files outside of the module's 'path', depending on the privileges assigned to the rsync daemon. Users not running an rsync daemon, running a read-only daemon, or running a chrooted daemon are not affected by this issue. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0426 to this issue.

Users of Rsync are advised to upgrade to this updated package, which contains a backported patch and is not affected by this issue.

The remote rsync server might be vulnerable to a path traversal issue.

An attacker may use this flaw to gain access to arbitrary files hosted outside of a module directory.

ID	Name	Product	Family	Severity
38112	FreeBSD : rsync path traversal issue (73ea0706-9c57-11d8-9366-0020ed76ef5a)	Nessus	FreeBSD Local Security Checks	medium
18768	Slackware 8.1 / 9.0 / 9.1 / current : rsync update (SSA:2004-124-01)	Nessus	Slackware Local Security Checks	medium
15336	Debian DSA-499-2 : rsync - directory traversal	Nessus	Debian Local Security Checks	medium
14676	Mac OS X Multiple Vulnerabilities (Security Update 2004-09-07)	Nessus	MacOS X Local Security Checks	high
14543	GLSA-200407-10 : rsync: Directory traversal in rsync daemon	Nessus	Gentoo Local Security Checks	medium
1216	rsync < 2.6.1 Traversal Arbitrary File Creation	Nessus Network Monitor	Generic	medium
14141	Mandrake Linux Security Advisory : rsync (MDKSA-2004:042)	Nessus	Mandriva Local Security Checks	medium
13695	Fedora Core 1 : rsync-2.5.7-5.fc1 (2004-116)	Nessus	Fedora Local Security Checks	medium
12497	RHEL 2.1 / 3 : rsync (RHSA-2004:192)	Nessus	Red Hat Local Security Checks	medium
12230	rsync Traversal Arbitrary File Creation	Nessus	Misc.	medium

Detections

Analytics

CVE-2004-0426

critical

Tenable Plugins

medium

medium

medium

high

medium

medium

medium

medium

medium

medium