rsync sanitize_path() Function Arbitrary File Disclosure

Medium Nessus Plugin ID 14223


Arbitrary files can be accessed from the remote host.


An information disclosure vulnerability exists in rsync due to improper validation of user-supplied input to the sanitize_path() function. An unauthenticated, remote attacker can exploit this, via a specially crafted path, to generated an absolute filename in place of a relative filename, resulting the disclosure of arbitrary files.
However, successful exploitation requires that the rsync daemon is not running chrooted.

Note that since rsync does not advertise its version number and since there are few details about this flaw at this time, this might be a false positive.


Upgrade to rsync version 2.6.3 or later.

Plugin Details

Severity: Medium

ID: 14223

File Name: rsync_path_sanitation_vuln.nasl

Version: $Revision: 1.22 $

Type: remote

Published: 2004/08/16

Modified: 2016/01/15

Dependencies: 11389

Risk Information

Risk Factor: Medium


Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Vulnerability Information

Required KB Items: Settings/ParanoidReport

Exploit Available: false

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 2004/08/13

Reference Information

CVE: CVE-2004-0792

BID: 10938

OSVDB: 8829