Bug 130050 - CAN-2004-0792 rsync path sanitizing bug
CAN-2004-0792 rsync path sanitizing bug
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 3
Classification: Red Hat
Component: rsync (Show other bugs)
3.0
All Linux
medium Severity medium
: ---
: ---
Assigned To: Jay Fenlason
Mike McLean
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2004-08-16 15:09 EDT by Josh Bressers
Modified: 2014-08-31 19:26 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2004-09-01 14:52:20 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Josh Bressers 2004-08-16 15:09:22 EDT
There is a path-sanitizing bug that affects daemon mode in all recent
rsync versions (including 2.6.2) but only if chroot is disabled. It
does NOT affect the normal send/receive filenames that specify what
files should be transferred (this is because these names happen to get
sanitized twice, and thus the second call removes any lingering
leading slash(es) that the first call left behind). It does affect
certain option paths that cause auxilliary files to be read or written.

More information here
http://samba.org/rsync/#security_aug04

FC is handled by bug 130044
Comment 1 Josh Bressers 2004-08-16 17:51:20 EDT
Here is the upstream patch to fix this issue.

--- orig/util.c	2004-04-27 12:59:37 -0700
+++ util.c	2004-08-11 23:37:27 -0700
@@ -743,7 +743,7 @@
 				allowdotdot = 1;
 			} else {
 				p += 2;
-				if (*p == '/')
+				while (*p == '/')
 					p++;
 				if (sanp != start) {
 					/* back up sanp one level */
Comment 2 Josh Bressers 2004-08-16 18:13:04 EDT
This is going to be RHSA-2004:436
Comment 3 Josh Bressers 2004-08-17 12:43:12 EDT
MITRE has assigned CAN-2004-0792 to this issue.
Comment 4 Josh Bressers 2004-09-01 14:52:20 EDT
An errata has been issued which should help the problem 
described in this bug report. This report is therefore being 
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files, 
please follow the link below. You may reopen this bug report 
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2004-436.html

Note You need to log in before you can comment on or make changes to this bug.