Directory traversal vulnerability in the sanitize_path function in util.c for rsync 2.6.2 and earlier, when chroot is disabled, allows attackers to read or write certain files.

An rsync security advisory reports :

There is a path-sanitizing bug that affects daemon mode in all recent rsync versions (including 2.6.2) but only if chroot is disabled.

The bug may allow a remote user to access files outside of an rsync module's configured path with the privileges configured for that module.

New rsync 2.6.3 packages are available for Slackware 8.1, 9.0, 9.1, 10.0, and -current to a fix security issue when rsync is run as a non-chrooted server.

The rsync developers have discovered a security related problem in rsync, a fast remote file copy program, which offers an attacker to access files outside of the defined directory. To exploit this path-sanitizing bug, rsync has to run in daemon mode with the chroot option being disabled. It does not affect the normal send/receive filenames that specify what files should be transferred. It does affect certain option paths that cause auxiliary files to be read or written.

An updated rsync package that fixes a path sanitizing bug is now available.

The rsync program synchronizes files over a network.

Versions of rsync up to and including version 2.6.2 contain a path sanitization issue. This issue could allow an attacker to read or write files outside of the rsync directory. This vulnerability is only exploitable when an rsync server is enabled and is not running within a chroot. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0792 to this issue.

Users of rsync are advised to upgrade to this updated package, which contains a backported patch and is not affected by this issue.

The remote host is affected by the vulnerability described in GLSA-200408-17 (rsync: Potential information leakage)

    The paths sent by the rsync client are not checked thoroughly enough.
    It does not affect the normal send/receive filenames that specify what     files should be transferred. It does affect certain option paths that     cause auxiliary files to be read or written.
  Impact :

    When rsyncd is used without chroot ('use chroot = false' in the     rsyncd.conf file), this vulnerability could allow the listing of     arbitrary files outside module's path and allow file overwriting     outside module's path on rsync server configurations that allows     uploading. Both possibilities are exposed only when chroot option is     disabled.
  Workaround :

    You should never set the rsync daemon to run with 'use chroot = false'.

An advisory was sent out by the rsync team regarding a security vulnerability in all versions of rsync prior to and including 2.6.2.
If rsync is running in daemon mode, and not in a chrooted environment, it is possible for a remote attacker to trick rsyncd into creating an absolute pathname while sanitizing it. This vulnerability allows a remote attacker to possibly read/write to/from files outside of the rsync directory.

The updated packages are patched to prevent this problem.

The remote host is running a rsync server, a program to synchronize files and directories structure across a network. The version running on the host may be vulnerable to a path escaping issue. An attacker may be able to write and read files in the context of the server.

An information disclosure vulnerability exists in rsync due to improper validation of user-supplied input to the sanitize_path() function. An unauthenticated, remote attacker can exploit this, via a specially crafted path, to generated an absolute filename in place of a relative filename, resulting the disclosure of arbitrary files.
However, successful exploitation requires that the rsync daemon is not running chrooted.

Note that since rsync does not advertise its version number and since there are few details about this flaw at this time, this might be a false positive.

ID	Name	Product	Family	Severity
18874	FreeBSD : rsync -- path sanitizing vulnerability (2689f4cb-ec4c-11d8-9440-000347a4fa7d)	Nessus	FreeBSD Local Security Checks	medium
18780	Slackware 10.0 / 8.1 / 9.0 / 9.1 / current : rsync (SSA:2004-285-01)	Nessus	Slackware Local Security Checks	medium
15375	Debian DSA-538-1 : rsync - unsanitised input processing	Nessus	Debian Local Security Checks	medium
14623	RHEL 2.1 / 3 : rsync (RHSA-2004:436)	Nessus	Red Hat Local Security Checks	medium
14573	GLSA-200408-17 : rsync: Potential information leakage	Nessus	Gentoo Local Security Checks	medium
14332	Mandrake Linux Security Advisory : rsync (MDKSA-2004:083)	Nessus	Mandriva Local Security Checks	medium
1965	Rsync < 2.6.3 Sanitize_path Function Module Path Escaping	Nessus Network Monitor	Generic	medium
14223	rsync sanitize_path() Function Arbitrary File Disclosure	Nessus	Gain a shell remotely	medium

Detections

Analytics

CVE-2004-0792

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium