PT-2004-1564 · Rsync · Rsync

Published 2004-04-30 · Updated 2017-10-11 · CVE-2004-0426

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions rsync versions prior to 2.6.1

Description The issue arises from improper path sanitization when running a read/write daemon without using chroot. This allows remote attackers to write files outside of the module's path.

Recommendations For versions prior to 2.6.1, update to version 2.6.1 or later to resolve the issue. As a temporary workaround, consider using chroot to restrict the daemon's access to the module's path.

Fix

Related Identifiers

CVE-2004-0426

DSA-499

RHSA-2004:192

Affected Products

Rsync

References · 27

• https://security-tracker.debian.org/tracker/CVE-2004-0426 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0426 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0426 · Security Note
• http://redhat.com/support/errata/RHSA-2004-192.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2004-0426 · Vendor Advisory
• http://trustix.net/errata/misc/2004/TSL-2004-0024-rsync.asc.txt · Vendor Advisory
• http://slackware.org/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.403462 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2004:042 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200407-10.xml · Vendor Advisory
• http://rsync.samba.org · Vendor Advisory
• http://debian.org/security/2004/dsa-499 · Vendor Advisory
• http://ciac.org/ciac/bulletins/o-212.shtml · Note
• http://marc.info/?l=bugtraq&m=108515912212018&w=2 · Note
• http://ciac.org/ciac/bulletins/o-134.shtml · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16014 · Note