PT-2007-7090 · Rsync+1 · Rsync+1

Published 2007-12-01 · Updated 2018-10-15 · CVE-2007-6200

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.0.0pre6

Description The issue allows remote attackers to bypass exclude, exclude from, and filter rules and read or write hidden files when running a writable rsync daemon. This can be achieved via options such as symlink, partial-dir, backup-dir, and an unspecified dest option.

Recommendations For versions prior to 3.0.0pre6, update to version 3.0.0pre6 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2007-6200

RHSA-2011:0999

RHSA-2011_0999

Affected Products

Red Hat

Rsync

References · 22

• https://security-tracker.debian.org/tracker/CVE-2007-6200 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-6200 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00002.html · Vendor Advisory
• http://secunia.com/advisories/27863 · Vendor Advisory
• http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2011-0999.html · Vendor Advisory
• http://mandriva.com/en/security/advisories?name=MDVSA-2008:011 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-6200 · Security Note
• http://rsync.samba.org/security.html#s3_0_0 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-6200 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2007-6200 · Note
• http://vupen.com/english/advisories/2008/2268 · Note
• http://secunia.com/advisories/27853 · Note
• http://securitytracker.com/id?1019012 · Note
• http://securityfocus.com/bid/26639 · Note