rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization path.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - rsync: daemon does not check for fnamecmp filenames allowing for access restriction bypass     (CVE-2017-17434)

  - rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the     synchronization path. (CVE-2014-9512)

  - rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote     attackers to bypass intended access restrictions. NOTE: the rsync development branch has significant use     beyond the rsync developers, e.g., the code has been copied for use in various GitHub projects.
    (CVE-2017-15994)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - rsync: daemon does not check for fnamecmp filenames allowing for access restriction bypass     (CVE-2017-17434)

  - rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the     synchronization path. (CVE-2014-9512)

  - rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote     attackers to bypass intended access restrictions. NOTE: the rsync development branch has significant use     beyond the rsync developers, e.g., the code has been copied for use in various GitHub projects.
    (CVE-2017-15994)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - rsync: daemon does not check for fnamecmp filenames allowing for access restriction bypass     (CVE-2017-17434)

  - rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the     synchronization path. (CVE-2014-9512)

  - rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote     attackers to bypass intended access restrictions. NOTE: the rsync development branch has significant use     beyond the rsync developers, e.g., the code has been copied for use in various GitHub projects.
    (CVE-2017-15994)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the version of the rsync package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - rsync 3.1.1 allows remote attackers to write to     arbitrary files via a symlink attack on a file in the     synchronization path.(CVE-2014-9512)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of macOS / Mac OS X that is 10.13.x prior to 10.13.6 Security Update 2020-004, 10.14.x prior to 10.14.6 Security Update 2020-004, or 10.15.x prior to 10.15.6. It is, therefore, affected by multiple vulnerabilities, including the following:

  - A vulnerability was discovered in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android that allows a malicious     access point, or an adjacent user, to determine if a connected user is using a VPN, make positive     inferences about the websites they are visiting, and determine the correct sequence and acknowledgement     numbers in use, allowing the bad actor to inject data into the TCP stream. This provides everything that     is needed for an attacker to hijack active connections inside the VPN tunnel. (CVE-2019-14899)

  - cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote     denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an     off-by-one error in _sasl_add_string in common.c in cyrus-sasl. (CVE-2019-19906)

  - In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands     via scripting interfaces (e.g., Python, Ruby, or Lua). (CVE-2019-20807)

  - rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the     synchronization path. (CVE-2014-9512)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

This update for rsync fixes the several issues.

These security issues were fixed :

  - CVE-2017-17434: The daemon in rsync did not check for     fnamecmp filenames in the daemon_filter_list data     structure (in the recv_files function in receiver.c) and     also did not apply the sanitize_paths protection     mechanism to pathnames found in 'xname follows' strings     (in the read_ndx_and_attrs function in rsync.c), which     allowed remote attackers to bypass intended access     restrictions' (bsc#1071460).

  - CVE-2017-17433: The recv_files function in receiver.c in     the daemon in rsync, proceeded with certain file     metadata updates before checking for a filename in the     daemon_filter_list data structure, which allowed remote     attackers to bypass intended access restrictions     (bsc#1071459).

  - CVE-2017-16548: The receive_xattr function in xattrs.c     in rsync did not check for a trailing '\\0' character in     an xattr name, which allowed remote attackers to cause a     denial of service (heap-based buffer over-read and     application crash) or possibly have unspecified other     impact by sending crafted data to the daemon     (bsc#1066644).

  - CVE-2014-9512: Prevent attackers to write to arbitrary     files via a symlink attack on a file in the     synchronization path (bsc#915410).

These non-security issues were fixed :

  - Stop file upload after errors like a full disk     (boo#1062063)

  - Ensure -X flag works even when setting owner/group     (boo#1028842)

rsync was updated to fix one security issue.

  - CVE-2014-9512: rsync allowed remote attackers to write     to arbitrary files via a symlink attack on a file in the     synchronization path (bsc#915410).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

rsync was updated to fix one security issue.

This security issue was fixed :

  - CVE-2014-9512: rsync allowed remote attackers to write     to arbitrary files via a symlink attack on a file in the     synchronization path (boo#915410).

The remote host is affected by the vulnerability described in GLSA-201605-04 (rsync: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in rsync. Please review       the CVE identifiers referenced below for details.
  Impact :

    Remote attackers could write arbitrary files via symlink attacks.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2879-1 advisory.

    It was discovered that rsync incorrectly handled invalid filenames. A malicious server could use this     issue to write files outside of the intended destination directory.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for rsync fixes two security issues :

  - CVE-2014-8242: Checksum collisions leading to a denial     of service (bsc#900914)

  - CVE-2014-9512: Malicious servers could send files     outside of the transferred directory (bsc#915410)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for rsync fixes two security issues and two non-security bugs.

The following vulnerabilities were fixed :

  - CVE-2014-8242: Checksum collisions leading to a denial     of service (bsc#900914)

  - CVE-2014-9512: Malicious servers could send files     outside of the transferred directory (bsc#915410)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

rsync was updated to fix one security issue.

This security issue was fixed :

  - Path spoofing attack vulnerability (CVE-2014-9512).

ID	Name	Product	Family	Severity
199479	RHEL 7 : rsync (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199467	RHEL 6 : rsync (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199412	RHEL 5 : rsync (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
153310	EulerOS 2.0 SP2 : rsync (EulerOS-SA-2021-2444)	Nessus	Huawei Local Security Checks	high
149112	EulerOS 2.0 SP3 : rsync (EulerOS-SA-2021-1844)	Nessus	Huawei Local Security Checks	high
141100	macOS 10.15.x < 10.15.6 / 10.14.x < 10.14.6 Security Update 2020-004 / 10.13.x < 10.13.6 Security Update 2020-004	Nessus	MacOS X Local Security Checks	critical
106063	openSUSE Security Update : rsync (openSUSE-2018-34)	Nessus	SuSE Local Security Checks	critical
93307	SUSE SLED12 / SLES12 Security Update : rsync (SUSE-SU-2016:2151-1)	Nessus	SuSE Local Security Checks	medium
93183	SUSE SLES11 Security Update : rsync (SUSE-SU-2016:1866-1)	Nessus	SuSE Local Security Checks	medium
91887	openSUSE Security Update : rsync (openSUSE-2016-803)	Nessus	SuSE Local Security Checks	medium
91865	openSUSE Security Update : rsync (openSUSE-2016-764)	Nessus	SuSE Local Security Checks	medium
91377	GLSA-201605-04 : rsync: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
88084	Ubuntu 14.04 LTS : rsync vulnerability (USN-2879-1)	Nessus	Ubuntu Local Security Checks	high
88009	SUSE SLED11 / SLES11 Security Update : rsync (SUSE-SU-2016:0176-1)	Nessus	SuSE Local Security Checks	medium
88007	SUSE SLED12 / SLES12 Security Update : rsync (SUSE-SU-2016:0173-1)	Nessus	SuSE Local Security Checks	medium
81286	openSUSE Security Update : rsync (openSUSE-2015-124)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2014-9512

high

Tenable Plugins

critical

critical

critical

high

high

critical

critical

medium

medium

medium

medium

medium

high

medium

medium

medium