Signature Detail

RSYNC: File Overwrite and Directory Traversal

This signature detects directory traversal attempts against rsync. Rsync enables users to specify a backup path outside of the main rsync tree. Attackers can specify a backup path that includes ".." characters to move one directory level higher.

Extended Description

If an rsync server is installed as a daemon with a read/write enabled module without using the 'chroot' option, it is possible that a remote attacker could write files outside of the configure module path. Rsync does not properly sanitize the paths when not running with chroot. The result is that attackers may potentially write files to the system, resulting in various consequences such as execution of arbitrary code or denial of service.

Affected Products

• Apple Mac OS X 10.2.8
• Apple Mac OS X 10.3.4
• Apple Mac OS X 10.3.5
• Apple Mac OS X Server 10.2.8
• Apple Mac OS X Server 10.3.4
• Apple Mac OS X Server 10.3.5
• Conectiva Linux 10.0.0
• Conectiva Linux 9.0.0
• Debian Linux 3.0.0
• Debian Linux 3.0.0 Alpha
• Debian Linux 3.0.0 Arm
• Debian Linux 3.0.0 Hppa
• Debian Linux 3.0.0 Ia-32
• Debian Linux 3.0.0 Ia-64
• Debian Linux 3.0.0 M68k
• Debian Linux 3.0.0 Mips
• Debian Linux 3.0.0 Mipsel
• Debian Linux 3.0.0 Ppc
• Debian Linux 3.0.0 S/390
• Debian Linux 3.0.0 Sparc
• Mandriva Corporate Server 2.1.0
• Mandriva Corporate Server 2.1.0 X86 64
• Mandriva Linux Mandrake 10.0.0
• Mandriva Linux Mandrake 9.1.0
• Mandriva Linux Mandrake 9.1.0 Ppc
• Mandriva Linux Mandrake 9.2.0
• Mandriva Linux Mandrake 9.2.0 amd64
• Mandriva Multi Network Firewall 2.0.0
• Red Hat Desktop 3.0.0
• Red Hat Enterprise Linux AS 2.1
• Red Hat Enterprise Linux AS 3
• Red Hat Enterprise Linux ES 2.1
• Red Hat Enterprise Linux ES 3
• Red Hat Enterprise Linux WS 2.1
• Red Hat Enterprise Linux WS 3
• Red Hat Linux Advanced Work Station 2.1.0
• rsync 2.3.1
• rsync 2.3.2
• rsync 2.3.2 -1.2 Alpha
• rsync 2.3.2 -1.2 ARM
• rsync 2.3.2 -1.2 Intel
• rsync 2.3.2 -1.2 M68k
• rsync 2.3.2 -1.2 PPC
• rsync 2.3.2 -1.2 Sparc
• rsync 2.3.2 -1.3
• rsync 2.4.0 .0
• rsync 2.4.1
• rsync 2.4.3
• rsync 2.4.4
• rsync 2.4.5
• rsync 2.4.6
• rsync 2.4.8
• rsync 2.5.0 .0
• rsync 2.5.1
• rsync 2.5.2
• rsync 2.5.3
• rsync 2.5.4
• rsync 2.5.5
• rsync 2.5.6
• rsync 2.5.7
• rsync 2.6.0

References

• BugTraq: 10247
• CVE: CVE-2004-0426
• URL: http://oval.mitre.org/oval/definitions/data/oval967.html
• URL: http://rsync.samba.org/