{"id":121341,"date":"2025-01-15T03:45:59","date_gmt":"2025-01-15T01:45:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-rsync-3-4-0-ustraneny-uyazvimosti-pozvolyavshie-vypolnit-kod-na-servere-i-kliente"},"modified":"2025-01-15T03:45:59","modified_gmt":"2025-01-15T01:45:59","slug":"v-rsync-3-4-0-ustraneny-uyazvimosti-pozvolyavshie-vypolnit-kod-na-servere-i-kliente","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/v-rsync-3-4-0-ustraneny-uyazvimosti-pozvolyavshie-vypolnit-kod-na-servere-i-kliente","title":{"rendered":"Az Rsync 3.4.0 verzi\u00f3ban jav\u00edtott\u00e1k a szerver- \u00e9s kliensoldali k\u00f3dv\u00e9grehajt\u00e1si sebezhet\u0151s\u00e9geket.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Megjelent az Rsync 3.4.0 f\u00e1jlszinkroniz\u00e1l\u00f3 eszk\u00f6z \u00faj verzi\u00f3ja, amely hat sebezhet\u0151s\u00e9get jav\u00edt. A CVE-2024-12084 \u00e9s CVE-2024-12085 sebezhet\u0151s\u00e9gek kombin\u00e1ci\u00f3ja lehet\u0151v\u00e9 teszi a kliens sz\u00e1m\u00e1ra, hogy k\u00f3dot futtasson a szerveren. A t\u00e1mad\u00e1shoz elegend\u0151 egy anonim kapcsolat az Rsync szerverhez olvas\u00e1si hozz\u00e1f\u00e9r\u00e9ssel. P\u00e9ld\u00e1ul a t\u00e1mad\u00e1s v\u00e9grehajthat\u00f3 k\u00fcl\u00f6nb\u00f6z\u0151 disztrib\u00faci\u00f3k \u00e9s projektek t\u00fckr\u00f6z\u00e9s\u00e9n, amelyek lehet\u0151v\u00e9 teszik a buildok let\u00f6lt\u00e9s\u00e9t Rsync-en kereszt\u00fcl. A probl\u00e9ma k\u00fcl\u00f6nf\u00e9le f\u00e1jlszinkroniz\u00e1l\u00f3 \u00e9s biztons\u00e1gi ment\u0151 alkalmaz\u00e1sokat is \u00e9rint, amelyek az Rsync-et h\u00e1tt\u00e9rk\u00e9nt haszn\u00e1lj\u00e1k, mint p\u00e9ld\u00e1ul az Rclone, DeltaCopy \u00e9s ChronoSync.    <\/p>\n<p>Tov\u00e1bb\u00e1, kihaszn\u00e1lva a sebezhet\u0151s\u00e9get, <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/hu\/server\/dts-newyork\/\"   title=\"szerveren\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2736\">szerveren<\/a> a t\u00e1mad\u00f3 t\u00e1mad\u00e1st ind\u00edthat a szerverhez csatlakoz\u00f3 kliensekkel szemben, \u00e9s el\u00e9rheti, hogy b\u00e1rmely f\u00e1jl olvas\u00e1s\u00e1t vagy \u00edr\u00e1s\u00e1t v\u00e9grehajtsa a rendszer\u00fckben, a rsync folyamat hozz\u00e1f\u00e9r\u00e9si jogait\u00f3l f\u00fcgg\u0151en. P\u00e9ld\u00e1ul rosszindulat\u00fa rsync-<a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/hu\/server\/\"   title=\"szerverek\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"1681\">szerverek<\/a> k\u00e9sz\u00edt\u00e9s\u00e9vel SSH-kulcsok t\u00f6lthet\u0151k le, vagy k\u00f3d v\u00e9grehajt\u00e1sa \u00e9rhet\u0151 el olyan f\u00e1jlok fel\u00fcl\u00edr\u00e1s\u00e1val, mint a ~\/ .bashrc \u00e9s ~\/ .popt.      <\/p>\n<p>A szerverek \u00faj Rsync verzi\u00f3ra val\u00f3 friss\u00edt\u00e9s\u00e9nek egyszer\u0171s\u00edt\u00e9se \u00e9rdek\u00e9ben az Rsync 3.4.0 kiad\u00e1s keret\u00e9ben a protokoll sz\u00e1ma 32-re emelkedett. Az el\u00e9rhet\u0151 friss\u00edt\u00e9sek nyomon k\u00f6vet\u00e9s\u00e9hez a disztrib\u00faci\u00f3kban az al\u00e1bbi oldalakon lehet inform\u00e1ci\u00f3t tal\u00e1lni: Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, Arch, FreeBSD.       <\/p>\n<p>Felt\u00e1rt sebezhet\u0151s\u00e9gek:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2024-12084 \u2014 a buffer overflow due to an incorrect checksum that exceeds 16 bytes.\n<li class=\"l\"> CVE-2024-12085 \u2014 a leak of uninitialized data from the stack (one byte at a time) during operations comparing checksums of incorrect sizes.\n<li class=\"l\"> CVE-2024-12086 \u2014 server access to arbitrary file contents from the client's system through the server generating incorrect communication tokens and checksums while copying files from the client to the server (determining content byte by byte through checksum guessing).\n<li class=\"l\"> CVE-2024-12087 \u2014 a chroot bypass vulnerability when using the '--inc-recursive' option (enabled by default for many flags). The vulnerability arises from insufficient checks on symbolic links and allows files to be written outside the specified target directory indicated by the client. The compromised server can exploit this vulnerability to attack the connected client's system.\n<li class=\"l\"> CVE-2024-12088 \u2014 incorrect checking of symbolic links pointing to other symbolic links when using the '--safe-links' option. This issue allows bypassing the base directory and writing data to any file in the system as permitted by access rights.\n<li class=\"l\"> CVE-2024-12747 \u2014 a race condition when working with symbolic links that allows a user to escalate their privileges and gain access to privileged files on the server.    <\/ul>\n<p>Forr\u00e1s: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=62557\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 Rsync 3.4.0, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e \u0448\u0435\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u041a\u043e\u043c\u0431\u0438\u043d\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 CVE-2024-12084 \u0438 CVE-2024-12085 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043a\u043b\u0438\u0435\u043d\u0442\u0443 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u0414\u043b\u044f \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u043e\u0433\u043e \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443 Rsync \u0441 \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043d\u0430 \u0447\u0442\u0435\u043d\u0438\u0435. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0430\u0442\u0430\u043a\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u043d\u0430 \u0437\u0435\u0440\u043a\u0430\u043b\u0430 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 \u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0445 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0441\u0431\u043e\u0440\u043e\u043a \u0447\u0435\u0440\u0435\u0437 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121341","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 Rsync 3.4.0, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e \u0448\u0435\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hu\/blog\/news\/v-rsync-3-4-0-ustraneny-uyazvimosti-pozvolyavshie-vypolnit-kod-na-servere-i-kliente\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"hu_HU\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412 Rsync 3.4.0 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0435 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 Rsync 3.4.0, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e \u0448\u0435\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hu\/blog\/news\/v-rsync-3-4-0-ustraneny-uyazvimosti-pozvolyavshie-vypolnit-kod-na-servere-i-kliente\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-01-15T01:45:59+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2025-01-15T01:45:59+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Az Rsync 3.4.0-ben jav\u00edtott\u00e1k azokat a s\u00e9r\u00fcl\u00e9keny\u00e9geket, amelyek lehet\u0151v\u00e9 tett\u00e9k k\u00f3d v\u00e9grehajt\u00e1s\u00e1t a szerveren \u00e9s a kliensen | ProHoster","description":"Megjelent az Rsync 3.4.0 f\u00e1jlszinkroniz\u00e1l\u00f3 seg\u00e9dprogram friss\u00edt\u00e9se, amely hat s\u00e9r\u00fcl\u00e9kenys\u00e9get orvosolt.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/v-rsync-3-4-0-ustraneny-uyazvimosti-pozvolyavshie-vypolnit-kod-na-servere-i-kliente","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Rsync 3.4.0 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0435 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 Rsync 3.4.0, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e \u0448\u0435\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/v-rsync-3-4-0-ustraneny-uyazvimosti-pozvolyavshie-vypolnit-kod-na-servere-i-kliente","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-01-15T01:45:59+00:00","article:modified_time":"2025-01-15T01:45:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121341","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:06:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 09:39:24","updated":"2026-02-09 22:06:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/121341","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=121341"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/121341\/revisions"}],"predecessor-version":[{"id":160016,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/121341\/revisions\/160016"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=121341"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=121341"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=121341"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}