UBUNTU-CVE-2017-17434

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2017-17434
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2017/UBUNTU-CVE-2017-17434.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2017-17434
Related
Published
2017-12-05T00:00:00Z
Modified
2017-12-05T00:00:00Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemonfilterlist data structure (in the recvfiles function in receiver.c) and also does not apply the sanitizepaths protection mechanism to pathnames found in "xname follows" strings (in the readndxand_attrs function in rsync.c), which allows remote attackers to bypass intended access restrictions.

References

Affected packages

Ubuntu:14.04:LTS / rsync

Package

Name
rsync
Purl
pkg:deb/ubuntu/rsync?arch=src?distro=trusty

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.1.0-2ubuntu0.3

Affected versions

3.*

3.0.9-4ubuntu1
3.1.0-2
3.1.0-2ubuntu0.1
3.1.0-2ubuntu0.2

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "3.1.0-2ubuntu0.3",
            "binary_name": "rsync"
        }
    ]
}

Ubuntu:16.04:LTS / rsync

Package

Name
rsync
Purl
pkg:deb/ubuntu/rsync?arch=src?distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.1.1-3ubuntu1.1

Affected versions

3.*

3.1.1-3
3.1.1-3ubuntu1

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "3.1.1-3ubuntu1.1",
            "binary_name": "rsync"
        }
    ]
}