PT-2017-14348 · Rsync Developers+1 · Rsync+1

Published 2017-10-29 · Updated 2019-10-03 · CVE-2017-15994

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions rsync versions prior to 2017-10-24

Description The issue makes it easier for remote attackers to bypass intended access restrictions by mishandling archaic checksums. This problem is not limited to the rsync developers, as the code has been used in various GitHub projects.

Recommendations For versions prior to 2017-10-24, update to a version that includes the fix for the checksum handling issue.

Fix

Weakness Enumeration

CWE-354

Related Identifiers

ALT-PU-2018-1219

CVE-2017-15994

Affected Products

Alt Linux

Rsync

References · 16

• https://bdu.fstec.ru/vul/2021-01395 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15994 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17434 · Security Note
• https://bdu.fstec.ru/vul/2019-04731 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-15994 · Security Note
• https://bdu.fstec.ru/vul/2021-01448 · Security Note
• https://errata.altlinux.org/ALT-PU-2018-1219 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16548 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17433 · Security Note
• https://osv.dev/vulnerability/CVE-2017-15994 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5764 · Security Note
• https://bdu.fstec.ru/vul/2018-01509 · Security Note
• https://git.samba.org/?p=rsync.git%3Ba=commit%3Bh=c252546ceeb0925eb8a4061315e3ff0a8c55b48b · Note
• https://git.samba.org/?p=rsync.git%3Ba=commit%3Bh=7b8a4ecd6ff9cdf4e5d3850ebf822f1e989255b3 · Note
• https://packages.altlinux.org/ru/vuln/CVE-2017-15994 · Note