Home

CVE-2017-17433

Description

The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the daemon_filter_list data structure, which allows remote attackers to bypass intended access restrictions.

Risk Information

Base Score
3.7
MODERATE
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS Score
Exploitation Probability
1.555

Associated Vulnerability

VulnerabilityOS Platform
fast, versatile, remote (and local) file-copying tool (USN-3506-1) rsync_3.1.0-2ubuntu0.3_i386.debLinux
fast, versatile, remote (and local) file-copying tool (USN-3506-1) rsync_3.1.0-2ubuntu0.3_amd64.debLinux
fast, versatile, remote (and local) file-copying tool (USN-3506-1) rsync_3.1.1-3ubuntu1.1_i386.debLinux
fast, versatile, remote (and local) file-copying tool (USN-3506-1) rsync_3.1.1-3ubuntu1.1_amd64.debLinux
fast, versatile, remote (and local) file-copying tool (USN-3506-1) rsync_3.1.2-2ubuntu0.1_i386.debLinux
fast, versatile, remote (and local) file-copying tool (USN-3506-1) rsync_3.1.2-2ubuntu0.1_amd64.debLinux
fast, versatile, remote (and local) file-copying tool (USN-3506-1) rsync_3.1.2-1ubuntu0.1_amd64.debLinux
fast, versatile, remote (and local) file-copying tool (USN-3506-1) rsync_3.1.2-1ubuntu0.1_i386.debLinux
rsync security update(DSA-4068-1) rsync_3.1.2-1+deb9u1_i386.debLinux
rsync security update(DSA-4068-1) rsync_3.1.2-1+deb9u1_amd64.debLinux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234