GLSA-200407-10 : rsync: Directory traversal in rsync daemon
Medium Nessus Plugin ID 14543
SynopsisThe remote Gentoo host is missing one or more security-related patches.
DescriptionThe remote host is affected by the vulnerability described in GLSA-200407-10 (rsync: Directory traversal in rsync daemon)
When rsyncd is used without chroot ('use chroot = false' in the rsyncd.conf file), the paths sent by the client are not checked thoroughly enough. If rsyncd is used with read-write permissions ('read only = false'), this vulnerability can be used to write files anywhere with the rights of the rsyncd daemon. With default Gentoo installations, rsyncd runs in a chroot, without write permissions and with the rights of the 'nobody' user.
On affected configurations and if the rsync daemon runs under a privileged user, a remote client can exploit this vulnerability to completely compromise the host.
You should never set the rsync daemon to run with 'use chroot = false'. If for some reason you have to run rsyncd without a chroot, then you should not set 'read only = false'.
SolutionAll users should update to the latest version of the rsync package.
# emerge sync # emerge -pv '>=net-misc/rsync-2.6.0-r2' # emerge '>=net-misc/rsync-2.6.0-r2'