Red Hat Bugzilla – Bug 407161
CVE-2007-6199 When rsync is run w/o chroot, symlinks that point outside daemon's root can be created
Last modified: 2010-10-22 16:52:57 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2007-6199 to the following vulnerability:
rsync before 3.0.0pre6, when running a writable rsync daemon that is not using chroot, allows remote attackers to access restricted files via unknown vectors that cause rsync to create a symlink that points outside of the module's hierarchy.
Red Hat does not consider this a security issue. Versions of rsync as shipped
with Red Hat Enterprise Linux 2.1, 3, 4 and 5 behave as expected and that
behavior was well documented. This is a feature enhancement that allows more
fine grained control over creating symbolic links in writable rsync modules.