|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
[SA12294] Rsync Path Sanitation Vulnerability
From: Secunia Security Advisories (sec-adv
secunia.com)
Date: Mon Aug 16 2004 - 07:50:08 CDT
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
TITLE:
Rsync Path Sanitation Vulnerability
SECUNIA ADVISORY ID:
SA12294
VERIFY ADVISORY:
http://secunia.com/advisories/12294/
CRITICAL:
Less critical
IMPACT:
Exposure of system information, Exposure of sensitive information
WHERE:
From remote
SOFTWARE:
rsync 2.x
http://secunia.com/product/2594/
DESCRIPTION:
A vulnerability has been reported in rsync, which potentially can be
exploited by malicious users to read or write arbitrary files on a
vulnerable system.
The vulnerability is caused due to an input validation error within
the "sanitize_path()" function of the "util.c" file.
Successful exploitation requires that the rsync daemon isn't running
chrooted.
The vulnerability affects version 2.6.2 and prior.
SOLUTION:
A fix is available in the CVS repository and will also be included in
version 2.6.3.
The vendor suggests setting "use chroot = true" for all modules in
the file "rsyncd.conf".
PROVIDED AND/OR DISCOVERED BY:
Reported by vendor.
ORIGINAL ADVISORY:
http://samba.org/rsync/#security_aug04
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
----------------------------------------------------------------------
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]