The remote host is affected by the vulnerability described in GLSA-200408-17 (rsync: Potential information leakage)

    The paths sent by the rsync client are not checked thoroughly enough.
    It does not affect the normal send/receive filenames that specify what     files should be transferred. It does affect certain option paths that     cause auxiliary files to be read or written.
  Impact :

    When rsyncd is used without chroot ('use chroot = false' in the     rsyncd.conf file), this vulnerability could allow the listing of     arbitrary files outside module's path and allow file overwriting     outside module's path on rsync server configurations that allows     uploading. Both possibilities are exposed only when chroot option is     disabled.
  Workaround :

    You should never set the rsync daemon to run with 'use chroot = false'.

sanitize_path()関数に対するユーザー指定の入力の不適切な検証により、rsyncに情報漏洩の脆弱性が存在します。認証されていないリモートの攻撃者がこれを悪用し、特別に細工されたパスを使用して、相対ファイル名の場所に絶対ファイル名を生成し、任意ファイルの漏洩に至る可能性があります。
ただし、悪用が成功するには、rsyncデーモンがchrootedを実行していないことが必要です。

rsyncはバージョン番号をアドバタイズしないため、現時点ではこの欠陥に関する詳細がほとんどないため、これは誤検出である可能性があります。

An updated rsync package that fixes a path sanitizing bug is now available.

The rsync program synchronizes files over a network.

Versions of rsync up to and including version 2.6.2 contain a path sanitization issue. This issue could allow an attacker to read or write files outside of the rsync directory. This vulnerability is only exploitable when an rsync server is enabled and is not running within a chroot. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0792 to this issue.

Users of rsync are advised to upgrade to this updated package, which contains a backported patch and is not affected by this issue.

An advisory was sent out by the rsync team regarding a security vulnerability in all versions of rsync prior to and including 2.6.2.
If rsync is running in daemon mode, and not in a chrooted environment, it is possible for a remote attacker to trick rsyncd into creating an absolute pathname while sanitizing it. This vulnerability allows a remote attacker to possibly read/write to/from files outside of the rsync directory.

The updated packages are patched to prevent this problem.

rsync 中存在一个信息泄露漏洞，这是未正确验证用户向 sanitize_path() 函数提供的输入所致。未经身份验证的远程攻击者可利用此问题，通过特别构建的路径生成绝对文件名，以替换相对文件名，进而导致任意文件泄露。
但是，成功利用需要 rsync 后台程序未运行 chrooted。

请注意，由于 rsync 未公布其版本号，并且目前关于此缺陷的详细信息很少，因此这可能是一则误报。

rsync 中有一個資訊洩漏弱點，這是不當驗證使用者對 sanitize_path() 函式提供的輸入所導致。未經驗證的遠端攻擊者可透過特製的路徑，利用此問題來產生絕對檔案名稱，以替換相對檔案名稱，進而導致洩漏任意檔案。
但是，要成功利用此弱點，rsync 程序不得未執行 chroot。

請注意，由於 rsync 不會公告其版本號碼，並且目前有關此瑕疵的詳細資訊很少，因此這可能是誤報。

The rsync developers have discovered a security related problem in rsync, a fast remote file copy program, which offers an attacker to access files outside of the defined directory. To exploit this path-sanitizing bug, rsync has to run in daemon mode with the chroot option being disabled. It does not affect the normal send/receive filenames that specify what files should be transferred. It does affect certain option paths that cause auxiliary files to be read or written.

An information disclosure vulnerability exists in rsync due to improper validation of user-supplied input to the sanitize_path() function. An unauthenticated, remote attacker can exploit this, via a specially crafted path, to generated an absolute filename in place of a relative filename, resulting the disclosure of arbitrary files.
However, successful exploitation requires that the rsync daemon is not running chrooted.

Note that since rsync does not advertise its version number and since there are few details about this flaw at this time, this might be a false positive.

New rsync 2.6.3 packages are available for Slackware 8.1, 9.0, 9.1, 10.0, and -current to a fix security issue when rsync is run as a non-chrooted server.

An rsync security advisory reports :

There is a path-sanitizing bug that affects daemon mode in all recent rsync versions (including 2.6.2) but only if chroot is disabled.

The bug may allow a remote user to access files outside of an rsync module's configured path with the privileges configured for that module.

The remote host is running a rsync server, a program to synchronize files and directories structure across a network. The version running on the host may be vulnerable to a path escaping issue. An attacker may be able to write and read files in the context of the server.

ID	名稱	產品	系列	已發布	已更新	嚴重性
14573	GLSA-200408-17 : rsync: Potential information leakage	Nessus	Gentoo Local Security Checks	2004/8/30	2021/1/6	medium
14223	rsync sanitize_path()関数の任意のファイルの漏洩	Nessus	Gain a shell remotely	2004/8/16	2018/7/27	medium
14623	RHEL 2.1 / 3 : rsync (RHSA-2004:436)	Nessus	Red Hat Local Security Checks	2004/9/1	2021/1/14	medium
14332	Mandrake Linux Security Advisory : rsync (MDKSA-2004:083)	Nessus	Mandriva Local Security Checks	2004/8/22	2021/1/6	medium
14223	rsync sanitize_path() 函数任意文件泄露	Nessus	Gain a shell remotely	2004/8/16	2018/7/27	medium
14223	rsync sanitize_path() 函式任意檔案洩漏	Nessus	Gain a shell remotely	2004/8/16	2018/7/27	medium
15375	Debian DSA-538-1 : rsync - unsanitised input processing	Nessus	Debian Local Security Checks	2004/9/29	2021/1/4	medium
14223	rsync sanitize_path() Function Arbitrary File Disclosure	Nessus	Gain a shell remotely	2004/8/16	2018/7/27	medium
18780	Slackware 10.0 / 8.1 / 9.0 / 9.1 / current : rsync (SSA:2004-285-01)	Nessus	Slackware Local Security Checks	2005/7/13	2021/1/14	medium
18874	FreeBSD : rsync -- path sanitizing vulnerability (2689f4cb-ec4c-11d8-9440-000347a4fa7d)	Nessus	FreeBSD Local Security Checks	2005/7/13	2021/1/6	medium
1965	Rsync < 2.6.3 Sanitize_path Function Module Path Escaping	Nessus Network Monitor	Generic	2004/8/20	2019/3/6	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium