Bug 130050

Summary: CAN-2004-0792 rsync path sanitizing bug
Product: Red Hat Enterprise Linux 3 Reporter: Josh Bressers <bressers>
Component: rsyncAssignee: Jay Fenlason <fenlason>
Status: CLOSED ERRATA QA Contact: Mike McLean <mikem>
Severity: medium Docs Contact:
Priority: medium    
Version: 3.0CC: jfeeney
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2004-09-01 18:52:20 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Josh Bressers 2004-08-16 19:09:22 UTC
There is a path-sanitizing bug that affects daemon mode in all recent
rsync versions (including 2.6.2) but only if chroot is disabled. It
does NOT affect the normal send/receive filenames that specify what
files should be transferred (this is because these names happen to get
sanitized twice, and thus the second call removes any lingering
leading slash(es) that the first call left behind). It does affect
certain option paths that cause auxilliary files to be read or written.

More information here
http://samba.org/rsync/#security_aug04

FC is handled by bug 130044

Comment 1 Josh Bressers 2004-08-16 21:51:20 UTC
Here is the upstream patch to fix this issue.

--- orig/util.c	2004-04-27 12:59:37 -0700
+++ util.c	2004-08-11 23:37:27 -0700
@@ -743,7 +743,7 @@
 				allowdotdot = 1;
 			} else {
 				p += 2;
-				if (*p == '/')
+				while (*p == '/')
 					p++;
 				if (sanp != start) {
 					/* back up sanp one level */

Comment 2 Josh Bressers 2004-08-16 22:13:04 UTC
This is going to be RHSA-2004:436

Comment 3 Josh Bressers 2004-08-17 16:43:12 UTC
MITRE has assigned CAN-2004-0792 to this issue.

Comment 4 Josh Bressers 2004-09-01 18:52:20 UTC
An errata has been issued which should help the problem 
described in this bug report. This report is therefore being 
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files, 
please follow the link below. You may reopen this bug report 
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2004-436.html