UBUNTU-CVE-2017-17434

See a problem?

Source

https://ubuntu.com/security/notices/UBUNTU-CVE-2017-17434

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2017/UBUNTU-CVE-2017-17434.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2017-17434

Related

Published

2017-12-05T00:00:00Z

Modified

2017-12-05T00:00:00Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemonfilterlist data structure (in the recvfiles function in receiver.c) and also does not apply the sanitizepaths protection mechanism to pathnames found in "xname follows" strings (in the readndxand_attrs function in rsync.c), which allows remote attackers to bypass intended access restrictions.

References

Affected packages

Ubuntu:14.04:LTS / rsync

Package

Name: rsync
Purl: pkg:deb/ubuntu/rsync@3.1.0-2ubuntu0.3?arch=src?distro=trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.1.0-2ubuntu0.3

Affected versions

3.*

3.0.9-4ubuntu1

3.1.0-2

3.1.0-2ubuntu0.1

3.1.0-2ubuntu0.2

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "rsync": "3.1.0-2ubuntu0.3"
        }
    ]
}

Ubuntu:16.04:LTS / rsync

Package

Name: rsync
Purl: pkg:deb/ubuntu/rsync@3.1.1-3ubuntu1.1?arch=src?distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.1.1-3ubuntu1.1

Affected versions

3.*

3.1.1-3

3.1.1-3ubuntu1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "rsync": "3.1.1-3ubuntu1.1"
        }
    ]
}