{"id":36023,"date":"2025-01-15T14:16:40","date_gmt":"2025-01-15T06:16:40","guid":{"rendered":"https:\/\/www.deepin.org\/?p=36023"},"modified":"2025-01-15T17:04:59","modified_gmt":"2025-01-15T09:04:59","slug":"rsync-vulnerability-announcement","status":"publish","type":"post","link":"https:\/\/www.deepin.org.cn\/en\/rsync-vulnerability-announcement\/","title":{"rendered":"RSYNC Vulnerability Announcement (Upgrade Patch Pushed)"},"content":{"rendered":"\"\"<\/p>\n
\n
\n

At 02:25 Beijing time on January 15, 2025, security researcher Nick Tait reported six security vulnerabilities in rsync on the oss-security mailing list. Among them, the most severe vulnerability allows attackers to execute arbitrary code on the server simply by having anonymous read access to the rsync server (such as a public mirror).<\/p>\n<\/div>\n

\n
\n

Vulnerability Details:<\/strong><\/h1>\n
    \n
  1. \n
    CVE-2024-12084 (CVSS: 9.8): There is a heap buffer overflow vulnerability in rsync due to improper handling of checksum lengths. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), attackers can perform out-of-bounds writes in the sum2 buffer. Affected versions: 3.2.7 to 3.4.0.<\/div>\n<\/li>\n
  2. \n
    CVE-2024-12085 (CVSS: 7.5): In the rsync daemon, when comparing file checksums, attackers can manipulate the checksum length, leading to comparisons with uninitialized memory, thereby leaking one byte of uninitialized stack data each time. Affected versions: All versions.<\/div>\n<\/li>\n
  3. \n
    CVE-2024-12086 (CVSS: 6.1): The rsync server may leak arbitrary file contents from the client. During the process of copying files from the client to the server, the server sends local data checksums for the client to compare. By sending specially crafted checksum values, attackers may reconstruct the data of these files byte by byte based on the client's responses. Affected versions: All versions.<\/div>\n<\/li>\n
  4. \n
    CVE-2024-12087 (CVSS: 6.5): There is a path traversal vulnerability in rsync. When the --inc-recursive option is enabled (many clients enable this by default), attackers can exploit this vulnerability to perform path traversal attacks. Affected versions: All versions.<\/div>\n<\/li>\n
  5. \n
    CVE-2024-12088 (CVSS: 6.5): The --copy-dest option in rsync has a symbolic link attack vulnerability. Attackers can exploit this vulnerability to overwrite files in the target directory. Affected versions: All versions.<\/div>\n<\/li>\n
  6. \n
    CVE-2024-12089 (CVSS: 6.5): The --backup-dir option in rsync has a symbolic link attack vulnerability. Attackers can exploit this vulnerability to create symbolic links in the backup directory, leading to file overwrites. Affected versions: All versions.<\/div>\n<\/li>\n<\/ol>\n

     <\/p>\n<\/div>\n<\/div>\n<\/div>\n

    \n
    \n

    Am I Affected?<\/strong><\/h1>\n

    If you have never installed the rsync package (which is not pre-installed in deepin 23), you are not affected by these vulnerabilities.<\/p>\n

    If you have never manually enabled any rsync-related services, you are not affected by these vulnerabilities.<\/p>\n

    Mitigation Measures<\/strong><\/h2>\n

    The upstream maintainers of rsync have prepared patches for the aforementioned vulnerabilities, which will be included in the upcoming upstream rsync 3.4.0 release (the deepin patched version is: 3.3.0+ds1-3).<\/p>\n

    Temporary Workarounds<\/strong><\/h2>\n

    We strongly recommend updating to the new version. If you wish to defer the update, you can take the following temporary measures:<\/p>\n

    If you do not require the use of checksums in rsync, you can disable the checksum option on the rsync server side. To do this:<\/p>\n

      \n
    1. \n
        \n
      1. \n
        Edit \/etc\/rsyncd.conf<\/code><\/div>\n<\/li>\n
      2. \n
        Add the line refuse options = checksum<\/code> to the configuration file.<\/div>\n<\/li>\n
      3. \n
        Restart the rsync service (systemctl restart rsync<\/code>).<\/div>\n<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<\/div>\n<\/div>\n

         <\/p>\n

        \n
        \n

        Timeline:<\/strong><\/p>\n