Samba Rsync 3.1.2 Pre 1

CPE Details

Samba Rsync 3.1.2 Pre 1
samba
rsync
3.1.2
2020-04-28
15h11 +00:00
2020-04-28
15h11 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:samba:rsync:3.1.2:pre1:*:*:*:*:*:*

Informations

Vendor

samba

Product

rsync

Version

3.1.2

Update

pre1

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2022-29154 2022-08-02 12h22 +00:00 An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file).
7.4
High
CVE-2018-5764 2018-01-17 21h00 +00:00 The parse_arguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses, which allows remote attackers to bypass an argument-sanitization protection mechanism.
7.5
High
CVE-2017-17433 2017-12-06 02h00 +00:00 The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the daemon_filter_list data structure, which allows remote attackers to bypass intended access restrictions.
3.7
Low
CVE-2017-17434 2017-12-06 02h00 +00:00 The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_filter_list data structure (in the recv_files function in receiver.c) and also does not apply the sanitize_paths protection mechanism to pathnames found in "xname follows" strings (in the read_ndx_and_attrs function in rsync.c), which allows remote attackers to bypass intended access restrictions.
9.8
Critical
CVE-2017-16548 2017-11-06 04h00 +00:00 The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact by sending crafted data to the daemon.
9.8
Critical
CVE-2017-15994 2017-10-29 05h00 +00:00 rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to bypass intended access restrictions. NOTE: the rsync development branch has significant use beyond the rsync developers, e.g., the code has been copied for use in various GitHub projects.
9.8
Critical