Bug 130044

Summary:	CAN-2004-0792 rsync path sanitizing bug
Product:	[Fedora] Fedora	Reporter:	Josh Bressers <bressers>
Component:	rsync	Assignee:	Jay Fenlason <fenlason>
Status:	CLOSED ERRATA	QA Contact:	Mike McLean <mikem>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	2	CC:	jfeeney, redhat-bugzilla
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2004-08-19 21:36:46 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Josh Bressers 2004-08-16 19:05:09 UTC

There is a path-sanitizing bug that affects daemon mode in all recent
rsync versions (including 2.6.2) but only if chroot is disabled. It
does NOT affect the normal send/receive filenames that specify what
files should be transferred (this is because these names happen to get
sanitized twice, and thus the second call removes any lingering
leading slash(es) that the first call left behind). It does affect
certain option paths that cause auxilliary files to be read or written.

More information here
http://samba.org/rsync/#security_aug04

Comment 1 Jay Fenlason 2004-08-19 21:36:46 UTC

updates for fedora core 1 and 2 have been pushed that address this 
vulnerability.

Comment 2 Mark J. Cox 2004-08-20 07:49:39 UTC

http://www.redhat.com/archives/fedora-announce-list/2004-August/msg00023.html
http://www.redhat.com/archives/fedora-announce-list/2004-August/msg00024.html