PT-2017-3913 · Rsync+3 · Rsync+3

Published 2017-12-05 · Updated 2025-01-13 · CVE-2017-17434

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions rsync versions 3.1.2 through 3.1.3-development before 2017-12-03

Description The issue arises from the daemon in rsync not checking for fnamecmp filenames in the daemon filter list data structure and not applying the sanitize paths protection mechanism to pathnames found in "xname follows" strings. This allows remote attackers to bypass intended access restrictions, potentially impacting the confidentiality, integrity, and availability of protected information.

Recommendations For rsync versions 3.1.2 through 3.1.3-development before 2017-12-03, consider disabling the recv files function in receiver.c and the read ndx and attrs function in rsync.c as a temporary workaround until a patch is available. Restrict access to the daemon filter list data structure and the "xname follows" strings to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2018-1219

BDU:2019-04731

CVE-2017-17434

DLA-1218-1

DSA-4068-1

MGASA-2017-0452

ROSA-SA-2025-2553

SUSE-SU-2018:0117-1

SUSE-SU-2018:0118-1

USN-3506-1

USN-3506-2

Affected Products

Alt Linux

Suse

Ubuntu

Rsync

References · 53

• https://osv.dev/vulnerability/USN-3506-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2017-17434 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-17434 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17434 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17433 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16548 · Security Note
• https://bdu.fstec.ru/vul/2019-04731 · Security Note
• https://bdu.fstec.ru/vul/2018-01509 · Security Note
• https://osv.dev/vulnerability/CVE-2017-17434 · Vendor Advisory
• https://debian.org/security/2017/dsa-4068 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2018-1219 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4068-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01448 · Security Note
• https://advisories.mageia.org/MGASA-2017-0452.html · Security Note
• https://ubuntu.com/security/CVE-2017-17433 · Vendor Advisory