| Vulnerability Name: | CVE-2004-0426 (CCN-16014) | ||||||||||||||||||||||||
| Assigned: | 2004-04-26 | ||||||||||||||||||||||||
| Published: | 2004-04-26 | ||||||||||||||||||||||||
| Updated: | 2017-10-11 | ||||||||||||||||||||||||
| Summary: | rsync before 2.6.1 does not properly sanitize paths when running a read/write daemon without using chroot, which allows remote attackers to write files outside of the module's path. | ||||||||||||||||||||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
| ||||||||||||||||||||||||
| CVSS v2 Severity: | 5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
| ||||||||||||||||||||||||
| Vulnerability Type: | CWE-Other | ||||||||||||||||||||||||
| Vulnerability Consequences: | File Manipulation | ||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2004-0426 Source: CCN Type: Conectiva Linux Security Announcement CLSA-2004:881 Fix for path sanitation vulnerabilities Source: BUGTRAQ Type: UNKNOWN 20040521 [OpenPKG-SA-2004.025] OpenPKG Security Advisory (rsync) Source: CCN Type: RHSA-2004-192 rsync security update Source: CONFIRM Type: Vendor Advisory http://rsync.samba.org/ Source: CCN Type: Samba Web site http://samba.org/ftp/rsync/NEWS Source: CCN Type: rsync download Web page rsync Source: CCN Type: SA11514 rsync Allows Writing Files Outside the Intended Directory Source: SECUNIA Type: UNKNOWN 11514 Source: SECUNIA Type: UNKNOWN 11515 Source: SECUNIA Type: UNKNOWN 11523 Source: SECUNIA Type: UNKNOWN 11537 Source: SECUNIA Type: UNKNOWN 11583 Source: SECUNIA Type: UNKNOWN 11669 Source: SECUNIA Type: UNKNOWN 11688 Source: SECUNIA Type: UNKNOWN 11993 Source: SECUNIA Type: UNKNOWN 12054 Source: CCN Type: CIAC Information Bulletin O-134 Debian rsync Source: CIAC Type: UNKNOWN O-134 Source: CCN Type: CIAC Information Bulletin O-212 Apple Security Update Source: CIAC Type: UNKNOWN O-212 Source: DEBIAN Type: Patch, Vendor Advisory DSA-499 Source: DEBIAN Type: DSA-499 rsync -- directory traversal Source: CCN Type: GLSA-200407-10 rsync: Directory traversal in rsync daemon Source: GENTOO Type: UNKNOWN GLSA-200407-10 Source: CCN Type: Trustix Secure Linux Security Advisory #2004-0024 rsync Source: MANDRAKE Type: UNKNOWN MDKSA-2004:042 Source: CCN Type: OpenPKG-SA-2004.025 Rsync Source: REDHAT Type: Patch, Vendor Advisory RHSA-2004:192 Source: BID Type: UNKNOWN 10247 Source: CCN Type: BID-10247 RSync Configured Module Path Escaping Vulnerability Source: CCN Type: slackware-security Mailing List, Mon, 3 May 2004 13:06:08 -0700 (PDT) rsync update (SSA:2004-124-01) Source: SLACKWARE Type: UNKNOWN SSA:2004-124-01 Source: TRUSTIX Type: UNKNOWN TSL-2004-0024 Source: XF Type: UNKNOWN rsync-write-files(16014) Source: XF Type: UNKNOWN rsync-write-files(16014) Source: OVAL Type: UNKNOWN oval:org.mitre.oval:def:9495 Source: OVAL Type: UNKNOWN oval:org.mitre.oval:def:967 | ||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration RedHat 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||
| |||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||