Published: 06/12/2017 Updated: 07/11/2023

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 3.7 | Impact Score: 1.4 | Exploitability Score: 2.2

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development prior to 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the daemon_filter_list data structure, which allows remote malicious users to bypass intended access restrictions.

Vulnerable Product	Search on Vulmon	Subscribe to Product
debian debian linux 8.0
debian debian linux 7.0
debian debian linux 9.0
samba rsync 3.1.2

Several security issues were fixed in rsync ...

Debian Bug report logs - #880954 rsync: CVE-2017-16548: receive_xattr heap overread with non null terminated name Package: src:rsync; Maintainer for src:rsync is Paul Slootman <paul@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 6 Nov 2017 09:27:02 UTC Severity: important Tags: fixed-u ...

Debian Bug report logs - #883667 rsync: CVE-2017-17433 Package: src:rsync; Maintainer for src:rsync is Paul Slootman <paul@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 6 Dec 2017 10:03:05 UTC Severity: important Tags: patch, security, upstream Found in versions rsync/311-1, rsync/ ...

Debian Bug report logs - #883665 rsync: CVE-2017-17434 Package: src:rsync; Maintainer for src:rsync is Paul Slootman <paul@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 6 Dec 2017 09:57:09 UTC Severity: important Tags: patch, security, upstream Found in versions rsync/311-1, rsync/ ...

The recv_files function in receiverc in the daemon in rsync 312, and 313-development before 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the daemon_filter_list data structure, which allows remote attackers to bypass intended access restrictions ...

The recv_files function in receiverc in the daemon in rsync 312, and 313-development before 2017-11-03, proceeds with certain file metadata updates before checking for a filename in the daemon_filter_list data structure, which allows remote attackers to bypass intended access restrictions ...

CWE-862 http://security.cucumberlinux.com/security/details.php?id=169 https://www.debian.org/security/2017/dsa-4068 https://lists.debian.org/debian-lts-announce/2017/12/msg00020.html https://bugzilla.redhat.com/show_bug.cgi?id=1522874#c4 https://git.samba.org/?p=rsync.git%3Ba=commit%3Bh=3e06d40029cfdce9d0f73d87cfd4edaf54be9c51 https://usn.ubuntu.com/3506-2/https://nvd.nist.gov

CVE-2017-17433

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect