The file synchronization utility Rsync has been updated to fix 6 critical vulnerabilities. To exploit some of these, an anonymous connection to the Rsync server with read access is sufficient.
Fixed vulnerabilities:
- CVE-2024-12084 — buffer overflow via incorrect checksum transmission, where the size exceeds 16 bytes.
- CVE-2024-12085 — leaking uninitialized data from the stack (one byte at a time) during checksum comparison operations of incorrect size.
- CVE-2024-12086 — gaining server access to arbitrary file contents from the client system by generating incorrect communication tokens and checksums during file transfers from client to server (determining contents byte by byte through checksum guessing).
- CVE-2024-12087 — escaping the base directory when using the --inc-recursive option (enabled by default for many flags). The vulnerability is caused by the lack of proper symbolic link checks and allows writing files outside the specified target directory provided by the client. A compromised server can exploit this vulnerability to attack the connecting client's system.
- CVE-2024-12088 — incorrect checks of symbolic links pointing to other symbolic links when using the --safe-links option. The issue allows escaping the base directory and writing data to any file in the system, subject to access rights.
- CVE-2024-12747 — a race condition when working with symbolic links that allows a user to elevate their privileges and access privileged files on the server.
This list of fixed vulnerabilities is sourced from the OpenNET website: https://www.opennet.ru/opennews/art.shtml?num=62557
Other changes in the new version:
- configure.ac: fixed a bug with IPv6 checks due to a missing return type.
- CI: moved the FreeBSD build to GitHub Actions.
- Added a hint that the proxy can handle both regular and SSL stream simultaneously.
- Fixed a warning about an unused variable.
- Updated popt to version 1.19.
- Support: added install_deps_ubuntu.sh script.
- CI: fixed rules for triggers.
- CI: added a build for Solaris.
- Apple silicon linker path details.
- acls: synchronization type for orig_umask and removal of compilation warnings for macOS.
- Fixed various warnings identified by clang-16.
- rrsync: corrected the incorrect parameter name in the SYNOPSIS manual.
- PTR_SUB introduced.
- Added basic connectivity check capability through rrsync.
- If the built-in zlib is not used, libcrypto is utilized.
- Correction for GCC15(-std=gnu23): fixed function pointer cast in qsort().
- Typos corrected in the manual.
Source: linux.org.ru
