Описание
rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process.
A flaw was found in rsync. A remote attacker can exploit this vulnerability by specifying an absolute path using the --temp-dir or --link-dest options. This bypasses the rename-confinement logic, allowing the attacker to write files to arbitrary locations outside the intended destination tree, potentially leading to unauthorized data modification or system disruption.
Отчет
This Important flaw in rsync allows an attacker to write files to arbitrary locations outside the intended destination. This occurs when a user is tricked into executing rsync with attacker-controlled absolute paths via the --temp-dir or --link-dest options, bypassing path confinement. The requirement for user interaction to supply malicious input prevents this from being a Critical severity issue.
Меры по смягчению последствий
Do not pass untrusted values into --temp-dir or --link-dest. If you need those options, keep the destination (and those dirs) free of writes by untrusted users so a parent cannot be swapped to a symlink. Do not use --partial-dir or --inplace when pulling from an untrusted server. If rsyncd runs with use chroot = no, restrict who can connect.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | rsync | Affected | ||
| Red Hat Enterprise Linux 6 | rsync | Affected | ||
| Red Hat Enterprise Linux 7 | rsync | Affected | ||
| Red Hat Enterprise Linux 8 | rsync | Affected | ||
| Red Hat Enterprise Linux 9 | rsync | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
8.1 High
CVSS3
Связанные уязвимости
rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process.
rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process.
rsync before 3.5.0contains an arbitrary file write vulnerability that ...
8.1 High
CVSS3