PT-2004-1564 · Rsync · Rsync

Publicado 2004-04-30 · Atualizado 2017-10-11 · CVE-2004-0426

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions rsync versions prior to 2.6.1

Description The issue arises from improper path sanitization when running a read/write daemon without using chroot. This allows remote attackers to write files outside of the module's path.

Recommendations For versions prior to 2.6.1, update to version 2.6.1 or later to resolve the issue. As a temporary workaround, consider using chroot to restrict the daemon's access to the module's path.

Correção

Identificadores relacionados

CVE-2004-0426

DSA-499

RHSA-2004:192

Produtos afetados

Rsync

Referências · 27

• http://ciac.org/ciac/bulletins/o-212.shtml · Nota
• http://marc.info/?l=bugtraq&m=108515912212018&w=2 · Nota
• http://ciac.org/ciac/bulletins/o-134.shtml · Nota
• https://security-tracker.debian.org/tracker/CVE-2004-0426 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16014 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0426 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A967 · Nota
• http://secunia.com/advisories/11688 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9495 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-0426 · Nota de Segurança
• http://secunia.com/advisories/11523 · Nota
• http://secunia.com/advisories/11993 · Nota
• http://redhat.com/support/errata/RHSA-2004-192.html · Aviso do Fabricante
• http://secunia.com/advisories/11515 · Nota
• http://secunia.com/advisories/11669 · Nota