{"id":121341,"date":"2025-01-15T03:45:59","date_gmt":"2025-01-15T01:45:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-rsync-3-4-0-ustraneny-uyazvimosti-pozvolyavshie-vypolnit-kod-na-servere-i-kliente"},"modified":"2025-01-15T03:45:59","modified_gmt":"2025-01-15T01:45:59","slug":"v-rsync-3-4-0-ustraneny-uyazvimosti-pozvolyavshie-vypolnit-kod-na-servere-i-kliente","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/v-rsync-3-4-0-ustraneny-uyazvimosti-pozvolyavshie-vypolnit-kod-na-servere-i-kliente","title":{"rendered":"I Rsync 3.4.0 \u00e5tg\u00e4rdades s\u00e5rbarheter som till\u00e4t k\u00f6rning av kod p\u00e5 servern och klienten.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Versionen av filsynkroniseringsverktyget Rsync 3.4.0 sl\u00e4pptes, vilket \u00e5tg\u00e4rdar sex s\u00e5rbarheter. Kombinationen av s\u00e5rbarheterna CVE-2024-12084 och CVE-2024-12085 g\u00f6r det m\u00f6jligt f\u00f6r en klient att \u00e5stadkomma exekvering av sin kod p\u00e5 servern. F\u00f6r att genomf\u00f6ra en attack r\u00e4cker det med en anonym anslutning till Rsync-servern med l\u00e4sbeh\u00f6righet. Till exempel kan attacker riktas mot speglar av olika distributioner och projekt som erbjuder nedladdning av byggnader via Rsync. Problemet ber\u00f6r \u00e4ven olika applikationer f\u00f6r filsynkronisering och backup som anv\u00e4nder Rsync som backend, s\u00e5som Rclone, DeltaCopy och ChronoSync.    <\/p>\n<p>Vidare kan en angripare, genom att utnyttja s\u00e5rbarheten p\u00e5 <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sv\/server\/dts-newyork\/\"   title=\"servern\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2736\">servern<\/a> organisera en attack mot klienterna som kopplar upp sig mot servern och \u00e5stadkomma l\u00e4sning eller skrivning av vilka filer som helst i deras system, beroende p\u00e5 beh\u00f6righeterna f\u00f6r processen rsync. Till exempel kan skadliga rsync-<a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sv\/server\/\"   title=\"servrar\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"1681\">servrar<\/a> anv\u00e4ndas f\u00f6r att ladda upp SSH-nycklar eller \u00e5stadkomma k\u00f6rning av kod genom att skriva \u00f6ver filer som ~\\\/ .bashrc och ~\\\/ .popt.      <\/p>\n<p>F\u00f6r att underl\u00e4tta uppgradering av servrar till den nya versionen av Rsync \u00e4r protokollnumret i Rsync 3.4.0 h\u00f6jt till 32. Du kan f\u00f6lja uppdateringar i distributionerna p\u00e5 f\u00f6ljande sidor: Debian, Ubuntu, RHEL, SUSE\\\/openSUSE, Fedora, Arch, FreeBSD.       <\/p>\n<p>Uppt\u00e4ckta s\u00e5rbarheter:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2024-12084 \u2014 skrivning utanf\u00f6r den allokerade bufferten genom att skicka en ogiltig kontrollsumma vars storlek \u00f6verstiger 16 byte.\n<li class=\"l\"> CVE-2024-12085 \u2014 l\u00e4ckage av inneh\u00e5ll fr\u00e5n oinitierade data p\u00e5 stacken (ett byte i taget) vid j\u00e4mf\u00f6relser av kontrollsummor av ogiltig storlek.\n<li class=\"l\"> CVE-2024-12086 \u2014 \u00e5tkomst fr\u00e5n servern till inneh\u00e5llet i godtyckliga filer fr\u00e5n kundens system genom generering av ogiltiga kommunikationstoken och kontrollsummor av servern under \u00f6verf\u00f6ring av filer fr\u00e5n kunden till servern (best\u00e4mning av inneh\u00e5ll byte f\u00f6r byte genom att pr\u00f6va kontrollsummor).\n<li class=\"l\"> CVE-2024-12087 \u2014 utanf\u00f6r den grundl\u00e4ggande katalogen vid anv\u00e4ndning av alternativet \u00ab--inc-recursive\u00bb (aktiverat som standard f\u00f6r m\u00e5nga flaggor). S\u00e5rbarheten orsakas av bristande kontroll av symboliska l\u00e4nkar och g\u00f6r det m\u00f6jligt att skriva filer utanf\u00f6r den angivna m\u00e5lkatalogen fr\u00e5n kunden. En server under angriparens kontroll kan utnyttja s\u00e5rbarheten f\u00f6r att attackera systemet hos den anslutna kunden.\n<li class=\"l\"> CVE-2024-12088 \u2014 ogiltig kontroll av symboliska l\u00e4nkar som pekar p\u00e5 andra symboliska l\u00e4nkar vid anv\u00e4ndning av alternativet \u00ab--safe-links\u00bb. Problemet m\u00f6jligg\u00f6r \u00e5tkomst utanf\u00f6r den grundl\u00e4ggande katalogen och att skriva data till vilken fil som helst i systemet, s\u00e5 l\u00e5ngt beh\u00f6righeterna till\u00e5ter.\n<li class=\"l\"> CVE-2024-12747 \u2014 kapprovsf\u00f6rh\u00e5llande vid hantering av symboliska l\u00e4nkar som g\u00f6r det m\u00f6jligt f\u00f6r anv\u00e4ndaren att h\u00f6ja sina privilegier och f\u00e5 tillg\u00e5ng till privilegierade filer p\u00e5 servern.    <\/ul>\n<p>K\u00e4lla: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=62557\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 Rsync 3.4.0, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e \u0448\u0435\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u041a\u043e\u043c\u0431\u0438\u043d\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 CVE-2024-12084 \u0438 CVE-2024-12085 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043a\u043b\u0438\u0435\u043d\u0442\u0443 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u0414\u043b\u044f \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u043e\u0433\u043e \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443 Rsync \u0441 \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043d\u0430 \u0447\u0442\u0435\u043d\u0438\u0435. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0430\u0442\u0430\u043a\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u043d\u0430 \u0437\u0435\u0440\u043a\u0430\u043b\u0430 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 \u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0445 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0441\u0431\u043e\u0440\u043e\u043a \u0447\u0435\u0440\u0435\u0437 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121341","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 Rsync 3.4.0, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e \u0448\u0435\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sv\/blog\/news\/v-rsync-3-4-0-ustraneny-uyazvimosti-pozvolyavshie-vypolnit-kod-na-servere-i-kliente\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sv_SE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412 Rsync 3.4.0 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0435 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 Rsync 3.4.0, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e \u0448\u0435\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sv\/blog\/news\/v-rsync-3-4-0-ustraneny-uyazvimosti-pozvolyavshie-vypolnit-kod-na-servere-i-kliente\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-01-15T01:45:59+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2025-01-15T01:45:59+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47I Rsync 3.4.0 har s\u00e5rbarheter \u00e5tg\u00e4rdats, som m\u00f6jliggjorde kodk\u00f6rning p\u00e5 servern och klienten | ProHoster","description":"En release av filsynkroniseringsverktyget Rsync 3.4.0 har publicerats, som \u00e5tg\u00e4rdar sex s\u00e5rbarheter.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/v-rsync-3-4-0-ustraneny-uyazvimosti-pozvolyavshie-vypolnit-kod-na-servere-i-kliente","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Rsync 3.4.0 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0435 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 Rsync 3.4.0, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e \u0448\u0435\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/v-rsync-3-4-0-ustraneny-uyazvimosti-pozvolyavshie-vypolnit-kod-na-servere-i-kliente","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-01-15T01:45:59+00:00","article:modified_time":"2025-01-15T01:45:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121341","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:06:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 09:39:24","updated":"2026-02-09 22:06:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/121341","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=121341"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/121341\/revisions"}],"predecessor-version":[{"id":160016,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/121341\/revisions\/160016"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=121341"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=121341"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=121341"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}