The parse_arguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses, which allows remote attackers to bypass an argument-sanitization protection mechanism.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - rsync: daemon does not check for fnamecmp filenames allowing for access restriction bypass     (CVE-2017-17434)

  - rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the     synchronization path. (CVE-2014-9512)

  - rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote     attackers to bypass intended access restrictions. NOTE: the rsync development branch has significant use     beyond the rsync developers, e.g., the code has been copied for use in various GitHub projects.
    (CVE-2017-15994)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - rsync: daemon does not check for fnamecmp filenames allowing for access restriction bypass     (CVE-2017-17434)

  - rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the     synchronization path. (CVE-2014-9512)

  - rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote     attackers to bypass intended access restrictions. NOTE: the rsync development branch has significant use     beyond the rsync developers, e.g., the code has been copied for use in various GitHub projects.
    (CVE-2017-15994)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - rsync: daemon does not check for fnamecmp filenames allowing for access restriction bypass     (CVE-2017-17434)

  - rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the     synchronization path. (CVE-2014-9512)

  - rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote     attackers to bypass intended access restrictions. NOTE: the rsync development branch has significant use     beyond the rsync developers, e.g., the code has been copied for use in various GitHub projects.
    (CVE-2017-15994)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Debian 9 host has a package installed that is affected by a vulnerability as referenced in the dla-2833 advisory.

  - The parse_arguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple
    --protect-args uses, which allows remote attackers to bypass an argument-sanitization protection     mechanism. (CVE-2018-5764)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the rsync package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The receive_xattr function in xattrs.c in rsync 3.1.2     and 3.1.3-development does not check for a trailing     '\0' character in an xattr name, which allows remote     attackers to cause a denial of service (heap-based     buffer over-read and application crash) or possibly     have unspecified other impact by sending crafted data     to the daemon.(CVE-2017-16548)

  - The parse_arguments function in options.c in rsyncd in     rsync before 3.1.3 does not prevent multiple
    --protect-args uses, which allows remote attackers to     bypass an argument-sanitization protection     mechanism.(CVE-2018-5764)

  - The recv_files function in receiver.c in the daemon in     rsync 3.1.2, and 3.1.3-development before 2017-12-03,     proceeds with certain file metadata updates before     checking for a filename in the daemon_filter_list data     structure, which allows remote attackers to bypass     intended access restrictions.(CVE-2017-17433)

  - rsync 3.1.3-development before 2017-10-24 mishandles     archaic checksums, which makes it easier for remote     attackers to bypass intended access restrictions. NOTE:
    the rsync development branch has significant use beyond     the rsync developers, e.g., the code has been copied     for use in various GitHub projects.(CVE-2017-15994)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the rsync package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The receive_xattr function in xattrs.c in rsync 3.1.2     and 3.1.3-development does not check for a trailing     '\\0' character in an xattr name, which allows remote     attackers to cause a denial of service (heap-based     buffer over-read and application crash) or possibly     have unspecified other impact by sending crafted data     to the daemon.(CVE-2017-16548)

  - The parse_arguments function in options.c in rsyncd in     rsync before 3.1.3 does not prevent multiple
    --protect-args uses, which allows remote attackers to     bypass an argument-sanitization protection     mechanism.(CVE-2018-5764)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the rsync package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The parse_arguments function in options.c in rsyncd in     rsync before 3.1.3 does not prevent multiple
    --protect-args uses, which allows remote attackers to     bypass an argument-sanitization protection     mechanism.(CVE-2018-5764)

  - The receive_xattr function in xattrs.c in rsync 3.1.2     and 3.1.3-development does not check for a trailing     '\\0' character in an xattr name, which allows remote     attackers to cause a denial of service (heap-based     buffer over-read and application crash) or possibly     have unspecified other impact by sending crafted data     to the daemon.(CVE-2017-16548)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Trail of Bits used the automated vulnerability discovery tools developed for the DARPA Cyber Grand Challenge to audit zlib. As rsync, a fast, versatile, remote (and local) file-copying tool, uses an embedded copy of zlib, those issues are also present in rsync.

CVE-2016-9840 In order to avoid undefined behavior, remove offset pointer optimization, as this is not compliant with the C standard.

CVE-2016-9841 Only use post-increment to be compliant with the C standard.

CVE-2016-9842 In order to avoid undefined behavior, do not shift negative values, as this is not compliant with the C standard.

CVE-2016-9843 In order to avoid undefined behavior, do not pre-decrement a pointer in big-endian CRC calculation, as this is not compliant with the C standard.

CVE-2018-5764 Prevent remote attackers from being able to bypass the argument-sanitization protection mechanism by ignoring --protect-args when already sent by client.

For Debian 8 'Jessie', these problems have been fixed in version 3.1.1-3+deb8u2.

We recommend that you upgrade your rsync packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the rsync package has been released.

According to the versions of the rsync package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The recv_files function in receiver.c in the daemon in     rsync 3.1.2, and 3.1.3-development before 2017-12-03,     proceeds with certain file metadata updates before     checking for a filename in the daemon_filter_list data     structure, which allows remote attackers to bypass     intended access restrictions.(CVE-2017-17433)

  - The daemon in rsync 3.1.2, and 3.1.3-development before     2017-12-03, does not check for fnamecmp filenames in     the daemon_filter_list data structure (in the     recv_files function in receiver.c) and also does not     apply the sanitize_paths protection mechanism to     pathnames found in 'xname follows' strings (in the     read_ndx_and_attrs function in rsync.c), which allows     remote attackers to bypass intended access     restrictions.(CVE-2017-17434)

  - The parse_arguments function in options.c in rsyncd in     rsync before 3.1.3 does not prevent multiple
    --protect-args uses, which allows remote attackers to     bypass an argument-sanitization protection     mechanism.(CVE-2018-5764)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201805-04 (rsync: Arbitrary command execution)

    A vulnerability was discovered in rsync&rsquo;s parse_arguments function in       options.c.
  Impact :

    Remote attackers could possibly execute arbitrary commands with the       privilege of the process.
  Workaround :

    There is no known workaround at this time.

This update for rsync fixes one issues.

This security issue was fixed :

  - CVE-2018-5764: The parse_arguments function in options.c     did not prevent multiple --protect-args uses, which     allowed remote attackers to bypass an     argument-sanitization protection mechanism     (bsc#1076503).

This update was imported from the SUSE:SLE-12:Update update project.

According to the version of the rsync package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The parse_arguments function in options.c in rsyncd in     rsync before 3.1.3 does not prevent multiple
    --protect-args uses, which allows remote attackers to     bypass an argument-sanitization protection     mechanism.(CVE-2018-5764)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New version 3.1.3, includes security fix for CVE-2018-5764

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Removing dependencies on systemd-units

----

New version 3.1.3, includes security fix for CVE-2018-5764

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New rsync packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3543-1 advisory.

    It was discovered that rsync incorrectly handled certain data input. An attacker could possibly use this     to cause a denial of service or execute arbitrary code. (CVE-2017-16548)

    It was discovered that rsync incorrectly parsed certain arguments. An attacker could possibly use this to     bypass arguments and execute arbitrary code. (CVE-2018-5764)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for rsync fixes one issues. This security issue was fixed :

  - CVE-2018-5764: The parse_arguments function in options.c     did not prevent multiple --protect-args uses, which     allowed remote attackers to bypass an     argument-sanitization protection mechanism     (bsc#1076503).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for rsync fixes one issues. This security issue was fixed :

  - CVE-2018-5764: The parse_arguments function in options.c     did not prevent multiple --protect-args uses, which     allowed remote attackers to bypass an     argument-sanitization protection mechanism (bsc#1076503)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was an injection vulnerability in the rsync file-copying tool.

For Debian 7 'Wheezy', this issue has been fixed in rsync version 3.0.9-4+deb7u2.

We recommend that you upgrade your rsync packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199479	RHEL 7 : rsync (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199467	RHEL 6 : rsync (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199412	RHEL 5 : rsync (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196122	RHEL 5 : rsync (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
196103	RHEL 7 : rsync (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
196099	RHEL 6 : rsync (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
155739	Debian DLA-2833-1 : rsync - LTS security update	Nessus	Debian Local Security Checks	high
135659	EulerOS Virtualization 3.0.2.2 : rsync (EulerOS-SA-2020-1497)	Nessus	Huawei Local Security Checks	critical
128947	EulerOS Virtualization for ARM 64 3.0.2.0 : rsync (EulerOS-SA-2019-1944)	Nessus	Huawei Local Security Checks	critical
128098	EulerOS 2.0 SP5 : rsync (EulerOS-SA-2019-1806)	Nessus	Huawei Local Security Checks	critical
123019	Debian DLA-1725-1 : rsync security update	Nessus	Debian Local Security Checks	critical
121943	Photon OS 2.0: Rsync PHSA-2018-2.0-0041	Nessus	PhotonOS Local Security Checks	high
121838	Photon OS 1.0: Rsync PHSA-2018-1.0-0132	Nessus	PhotonOS Local Security Checks	high
117553	EulerOS Virtualization 2.5.0 : rsync (EulerOS-SA-2018-1244)	Nessus	Huawei Local Security Checks	critical
109627	GLSA-201805-04 : rsync: Arbitrary command execution	Nessus	Gentoo Local Security Checks	high
107244	openSUSE Security Update : rsync (openSUSE-2018-237)	Nessus	SuSE Local Security Checks	high
106778	EulerOS 2.0 SP2 : rsync (EulerOS-SA-2018-1050)	Nessus	Huawei Local Security Checks	high
106777	EulerOS 2.0 SP1 : rsync (EulerOS-SA-2018-1049)	Nessus	Huawei Local Security Checks	high
106646	Fedora 27 : rsync (2018-d0ebfab3f3)	Nessus	Fedora Local Security Checks	high
106611	Fedora 26 : rsync (2018-034101216d)	Nessus	Fedora Local Security Checks	high
106565	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : rsync (SSA:2018-032-02)	Nessus	Slackware Local Security Checks	critical
106295	Ubuntu 14.04 LTS / 16.04 LTS : rsync vulnerabilities (USN-3543-1)	Nessus	Ubuntu Local Security Checks	critical
106263	SUSE SLED12 / SLES12 Security Update : rsync (SUSE-SU-2018:0174-1)	Nessus	SuSE Local Security Checks	high
106261	SUSE SLES11 Security Update : rsync (SUSE-SU-2018:0172-1)	Nessus	SuSE Local Security Checks	high
106174	Debian DLA-1247-1 : rsync security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-5764

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

high

critical

critical

critical

critical

high

high

critical

high

high

high

high

high

high

critical

critical

high

high

high