Bug 130044 - CAN-2004-0792 rsync path sanitizing bug
CAN-2004-0792 rsync path sanitizing bug
Product: Fedora
Classification: Fedora
Component: rsync (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Jay Fenlason
Mike McLean
: Security
Depends On:
  Show dependency treegraph
Reported: 2004-08-16 15:05 EDT by Josh Bressers
Modified: 2014-08-31 19:26 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2004-08-19 17:36:46 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Josh Bressers 2004-08-16 15:05:09 EDT
There is a path-sanitizing bug that affects daemon mode in all recent
rsync versions (including 2.6.2) but only if chroot is disabled. It
does NOT affect the normal send/receive filenames that specify what
files should be transferred (this is because these names happen to get
sanitized twice, and thus the second call removes any lingering
leading slash(es) that the first call left behind). It does affect
certain option paths that cause auxilliary files to be read or written.

More information here
Comment 1 Jay Fenlason 2004-08-19 17:36:46 EDT
updates for fedora core 1 and 2 have been pushed that address this 

Note You need to log in before you can comment on or make changes to this bug.