Описание
Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.
A flaw was found in rsync. When an rsync daemon is configured with "daemon chroot = /X" and uses hostname-based access control lists (ACLs), and the chrooted directory /X lacks necessary DNS resolution files, a remote attacker can bypass hostname-based deny rules. This occurs because the daemon performs reverse-DNS lookups after chrooting, causing the lookup to fail and the connecting hostname to be identified as "UNKNOWN". An attacker can exploit this by controlling their pointer (PTR) record, enabling unauthorized connections from hostnames that should have been denied.
Отчет
This Moderate flaw in rsync allows an attacker to bypass hostname-based access controls on an rsync daemon configured with daemon chroot = /X when the chrooted environment lacks DNS resolution support. This bypass occurs because reverse-DNS lookups fail, causing the connecting hostname to be identified as "UNKNOWN". IP-based access controls are not affected.
Меры по смягчению последствий
To mitigate this issue, ensure that the chrooted environment (/X) for any rsync daemon configured with daemon chroot = /X includes the necessary DNS resolution files (e.g., /etc/resolv.conf, /etc/nsswitch.conf, /etc/hosts, and NSS service modules). Alternatively, configure rsync daemon access controls using IP addresses instead of hostnames, as IP-based ACLs are not affected. A restart of the rsync service may be required for configuration changes to take effect.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | rsync | Out of support scope | ||
| Red Hat Enterprise Linux 6 | rsync | Fix deferred | ||
| Red Hat Enterprise Linux 7 | rsync | Fix deferred | ||
| Red Hat Enterprise Linux 8 | rsync | Fix deferred | ||
| Red Hat Enterprise Linux 9 | rsync | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | rhcos | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
4.2 Medium
CVSS3
Связанные уязвимости
Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.
Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.
Rsync < 3.4.3 Authorization Bypass via Hostname Resolution
Rsync version3.4.2 and prior contain an authorization bypass vulnerabi ...
Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.
EPSS
4.2 Medium
CVSS3