Описание
Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.
A flaw was found in rsync. A network attacker can exploit an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function by sending a malformed HTTP proxy response. This occurs when the RSYNC_PROXY environment variable is set and the attacker sends a response line of 1023 or more bytes without a newline terminator. This can corrupt stack memory, potentially leading to a Denial of Service (DoS).
Меры по смягчению последствий
To mitigate this issue, ensure that the RSYNC_PROXY environment variable is not set. If rsync is configured to use an HTTP proxy via this variable, unsetting it will prevent exploitation. To unset the RSYNC_PROXY environment variable for the current session, use: unset RSYNC_PROXY. For a more permanent solution, ensure that RSYNC_PROXY is not defined in system-wide or user-specific environment configuration files. Note that this mitigation will disable rsync's ability to use an HTTP proxy, which may impact functionality if proxy usage is required.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | rsync | Fix deferred | ||
| Red Hat Enterprise Linux 6 | rsync | Fix deferred | ||
| Red Hat Enterprise Linux 7 | rsync | Fix deferred | ||
| Red Hat Enterprise Linux 8 | rsync | Fix deferred | ||
| Red Hat Enterprise Linux 9 | rsync | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | rhcos | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
5.9 Medium
CVSS3
Связанные уязвимости
Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.
Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.
Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack ...
EPSS
5.9 Medium
CVSS3