CVE-2018-5764

HIGH
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

The parse_arguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses, which allows remote attackers to bypass an argument-sanitization protection mechanism.

References

http://www.securityfocus.com/bid/102803

http://www.securitytracker.com/id/1040276

https://download.samba.org/pub/rsync/src-previews/rsync-3.1.3pre1-NEWS

https://git.samba.org/rsync.git/?p=rsync.git;a=commit;h=7706303828fcde524222babb2833864a4bd09e07

https://lists.debian.org/debian-lts-announce/2018/01/msg00021.html

https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html

https://security.gentoo.org/glsa/201805-04

https://usn.ubuntu.com/3543-1/

Details

Source: MITRE

Published: 2018-01-17

Updated: 2019-10-03

Risk Information

CVSS v2

Base Score: 5

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

Impact Score: 2.9

Exploitability Score: 10

Severity: MEDIUM

CVSS v3

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Impact Score: 3.6

Exploitability Score: 3.9

Severity: HIGH

Tenable Plugins

View all (20 total)

IDNameProductFamilySeverity
135659EulerOS Virtualization 3.0.2.2 : rsync (EulerOS-SA-2020-1497)NessusHuawei Local Security Checks
critical
128947EulerOS Virtualization for ARM 64 3.0.2.0 : rsync (EulerOS-SA-2019-1944)NessusHuawei Local Security Checks
critical
128098EulerOS 2.0 SP5 : rsync (EulerOS-SA-2019-1806)NessusHuawei Local Security Checks
critical
123019Debian DLA-1725-1 : rsync security updateNessusDebian Local Security Checks
critical
121943Photon OS 2.0: Rsync PHSA-2018-2.0-0041NessusPhotonOS Local Security Checks
high
121838Photon OS 1.0: Rsync PHSA-2018-1.0-0132NessusPhotonOS Local Security Checks
high
117553EulerOS Virtualization 2.5.0 : rsync (EulerOS-SA-2018-1244)NessusHuawei Local Security Checks
critical
111934Photon OS 1.0: Linux / Rsync PHSA-2018-1.0-0132 (deprecated)NessusPhotonOS Local Security Checks
high
111300Photon OS 2.0 : ceph / linux-esx / rsync / linux / linux-secure / linux-aws (PhotonOS-PHSA-2018-2.0-0041) (deprecated)NessusPhotonOS Local Security Checks
high
109627GLSA-201805-04 : rsync: Arbitrary command executionNessusGentoo Local Security Checks
high
107244openSUSE Security Update : rsync (openSUSE-2018-237)NessusSuSE Local Security Checks
high
106778EulerOS 2.0 SP2 : rsync (EulerOS-SA-2018-1050)NessusHuawei Local Security Checks
high
106777EulerOS 2.0 SP1 : rsync (EulerOS-SA-2018-1049)NessusHuawei Local Security Checks
high
106646Fedora 27 : rsync (2018-d0ebfab3f3)NessusFedora Local Security Checks
high
106611Fedora 26 : rsync (2018-034101216d)NessusFedora Local Security Checks
high
106565Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : rsync (SSA:2018-032-02)NessusSlackware Local Security Checks
critical
106295Ubuntu 14.04 LTS / 16.04 LTS / 17.10 : rsync vulnerabilities (USN-3543-1)NessusUbuntu Local Security Checks
critical
106263SUSE SLED12 / SLES12 Security Update : rsync (SUSE-SU-2018:0174-1)NessusSuSE Local Security Checks
high
106261SUSE SLES11 Security Update : rsync (SUSE-SU-2018:0172-1)NessusSuSE Local Security Checks
high
106174Debian DLA-1247-1 : rsync security updateNessusDebian Local Security Checks
high