{"id":121341,"date":"2025-01-15T03:45:59","date_gmt":"2025-01-15T01:45:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-rsync-3-4-0-ustraneny-uyazvimosti-pozvolyavshie-vypolnit-kod-na-servere-i-kliente"},"modified":"2025-01-15T03:45:59","modified_gmt":"2025-01-15T01:45:59","slug":"v-rsync-3-4-0-ustraneny-uyazvimosti-pozvolyavshie-vypolnit-kod-na-servere-i-kliente","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/v-rsync-3-4-0-ustraneny-uyazvimosti-pozvolyavshie-vypolnit-kod-na-servere-i-kliente","title":{"rendered":"O Rsync 3.4.0 corrigiu vulnerabilidades que permitiam a execu\u00e7\u00e3o de c\u00f3digo no servidor e no cliente","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Foi lan\u00e7ado o release da ferramenta de sincroniza\u00e7\u00e3o de arquivos Rsync 3.4.0, que corrige seis vulnerabilidades. A combina\u00e7\u00e3o das vulnerabilidades CVE-2024-12084 e CVE-2024-12085 permite que um cliente execute seu c\u00f3digo no servidor. Para realizar um ataque, basta uma conex\u00e3o an\u00f4nima ao servidor Rsync com acesso de leitura. Por exemplo, um ataque pode ser realizado em espelhos de v\u00e1rias distribui\u00e7\u00f5es e projetos que oferecem a possibilidade de baixar compila\u00e7\u00f5es atrav\u00e9s do Rsync. O problema tamb\u00e9m afeta v\u00e1rios aplicativos de sincroniza\u00e7\u00e3o de arquivos e backup que usam o Rsync como backend, como Rclone, DeltaCopy e ChronoSync.    <\/p>\n<p>Al\u00e9m disso, explorando a vulnerabilidade em <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/pt\/server\/dts-newyork\/\"   title=\"servidor\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2736\">servidor<\/a> o atacante pode organizar um ataque a clientes conectados ao servidor e obter a leitura ou grava\u00e7\u00e3o de quaisquer arquivos em seu sistema, conforme permitido pelas permiss\u00f5es do processo rsync. Por exemplo, atrav\u00e9s da cria\u00e7\u00e3o de rsyncs maliciosos,<a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/pt\/server\/\"   title=\"servidores\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"1681\">servidores<\/a> \u00e9 poss\u00edvel organizar o upload de chaves SSH ou executar c\u00f3digo, sobrescrevendo arquivos como ~\/ .bashrc e ~\/ .popt.      <\/p>\n<p>Para facilitar a verifica\u00e7\u00e3o da atualiza\u00e7\u00e3o dos servidores para a nova vers\u00e3o do Rsync, o n\u00famero do protocolo na vers\u00e3o 3.4.0 foi elevado para 32. \u00c9 poss\u00edvel acompanhar o surgimento de atualiza\u00e7\u00f5es nas distribui\u00e7\u00f5es nas seguintes p\u00e1ginas: Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, Arch, FreeBSD.       <\/p>\n<p>Vulnerabilidades identificadas:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2024-12084 \u2014 grava\u00e7\u00e3o fora do buffer alocado devido \u00e0 transmiss\u00e3o de uma soma de verifica\u00e7\u00e3o incorreta com tamanho superior a 16 bytes.\n<li class=\"l\"> CVE-2024-12085 \u2014 vazamento de conte\u00fado de dados n\u00e3o inicializados da pilha (um byte por vez) ao realizar opera\u00e7\u00f5es de compara\u00e7\u00e3o de somas de verifica\u00e7\u00e3o de tamanho incorreto.\n<li class=\"l\"> CVE-2024-12086 \u2014 acesso do servidor ao conte\u00fado de arquivos arbitr\u00e1rios do sistema do cliente atrav\u00e9s da gera\u00e7\u00e3o de tokens de comunica\u00e7\u00e3o e somas de verifica\u00e7\u00e3o incorretas pelo servidor durante a c\u00f3pia de arquivos do cliente para o servidor (determina\u00e7\u00e3o do conte\u00fado byte a byte por meio da manipula\u00e7\u00e3o da soma de verifica\u00e7\u00e3o).\n<li class=\"l\"> CVE-2024-12087 \u2014 sa\u00edda do diret\u00f3rio base ao usar a op\u00e7\u00e3o \u2018--inc-recursive\u2019 (que \u00e9 ativada por padr\u00e3o para muitos sinalizadores). A vulnerabilidade \u00e9 causada pela falta de verifica\u00e7\u00e3o adequada de links simb\u00f3licos e permite a grava\u00e7\u00e3o de arquivos fora do diret\u00f3rio de destino especificado pelo cliente. Um servidor controlado pelo atacante pode explorar essa vulnerabilidade para atacar o sistema do cliente conectado.\n<li class=\"l\"> CVE-2024-12088 \u2014 verifica\u00e7\u00e3o inadequada de links simb\u00f3licos que apontam para outros links simb\u00f3licos ao utilizar a op\u00e7\u00e3o \u2018--safe-links\u2019. O problema permite a sa\u00edda do diret\u00f3rio base e a grava\u00e7\u00e3o de dados em qualquer arquivo no sistema, conforme permitido pelas permiss\u00f5es.\n<li class=\"l\"> CVE-2024-12747 \u2014 condi\u00e7\u00e3o de corrida ao trabalhar com links simb\u00f3licos, permitindo que o usu\u00e1rio eleve suas permiss\u00f5es e acesse arquivos privilegiados no servidor.    <\/ul>\n<p>Fonte: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=62557\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 Rsync 3.4.0, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e \u0448\u0435\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u041a\u043e\u043c\u0431\u0438\u043d\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 CVE-2024-12084 \u0438 CVE-2024-12085 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043a\u043b\u0438\u0435\u043d\u0442\u0443 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u0414\u043b\u044f \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u043e\u0433\u043e \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443 Rsync \u0441 \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043d\u0430 \u0447\u0442\u0435\u043d\u0438\u0435. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0430\u0442\u0430\u043a\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u043d\u0430 \u0437\u0435\u0440\u043a\u0430\u043b\u0430 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 \u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0445 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0441\u0431\u043e\u0440\u043e\u043a \u0447\u0435\u0440\u0435\u0437 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121341","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 Rsync 3.4.0, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e \u0448\u0435\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/pt\/blog\/news\/v-rsync-3-4-0-ustraneny-uyazvimosti-pozvolyavshie-vypolnit-kod-na-servere-i-kliente\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"pt_PT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412 Rsync 3.4.0 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0435 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 Rsync 3.4.0, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e \u0448\u0435\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/pt\/blog\/news\/v-rsync-3-4-0-ustraneny-uyazvimosti-pozvolyavshie-vypolnit-kod-na-servere-i-kliente\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-01-15T01:45:59+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2025-01-15T01:45:59+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47O Rsync 3.4.0 corrige vulnerabilidades que permitiam a execu\u00e7\u00e3o de c\u00f3digo no servidor e no cliente | ProHoster","description":"Foi lan\u00e7ado o utilit\u00e1rio de sincroniza\u00e7\u00e3o de arquivos Rsync 3.4.0, que corrige seis vulnerabilidades.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/v-rsync-3-4-0-ustraneny-uyazvimosti-pozvolyavshie-vypolnit-kod-na-servere-i-kliente","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Rsync 3.4.0 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0435 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 Rsync 3.4.0, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e \u0448\u0435\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/v-rsync-3-4-0-ustraneny-uyazvimosti-pozvolyavshie-vypolnit-kod-na-servere-i-kliente","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-01-15T01:45:59+00:00","article:modified_time":"2025-01-15T01:45:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121341","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:06:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 09:39:24","updated":"2026-02-09 22:06:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/121341","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=121341"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/121341\/revisions"}],"predecessor-version":[{"id":160016,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/121341\/revisions\/160016"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=121341"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=121341"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=121341"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}