Detections
Analytics

RHEL 2.1 / 3 : rsync (RHSA-2004:436)

medium Nessus Plugin ID 14623

Synopsis

The remote Red Hat host is missing a security update.

Description

An updated rsync package that fixes a path sanitizing bug is now available.

The rsync program synchronizes files over a network.

Versions of rsync up to and including version 2.6.2 contain a path sanitization issue. This issue could allow an attacker to read or write files outside of the rsync directory. This vulnerability is only exploitable when an rsync server is enabled and is not running within a chroot. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0792 to this issue.

Users of rsync are advised to upgrade to this updated package, which contains a backported patch and is not affected by this issue.

Solution

Update the affected rsync package.

See Also

http://rsync.samba.org/#security_aug04

https://access.redhat.com/errata/RHSA-2004:436

https://access.redhat.com/security/cve/cve-2004-0792

Plugin Details

Severity: Medium

ID: 14623

File Name: redhat-RHSA-2004-436.nasl

Version: 1.29

Type: Local

Agent: unix

Published: 9/1/2004

Updated: 1/14/2021

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.04

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:rsync, cpe:/o:redhat:enterprise_linux:2.1, cpe:/o:redhat:enterprise_linux:3

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Patch Publication Date: 9/1/2004

Vulnerability Publication Date: 10/20/2004

Reference Information

CVE: CVE-2004-0792

RHSA: 2004:436