Caldera rsync Vulnerability
BID:145
Info
Caldera rsync Vulnerability
| Bugtraq ID: | 145 |
| Class: | Unknown |
| CVE: | |
| Remote: | Unknown |
| Local: | Unknown |
| Published: | May 04 1999 12:00AM |
| Updated: | May 04 1999 12:00AM |
| Credit: | This bug was found internally by the developers of rsync, Caldera issued an advisory about this problem to their website on May 4/1999. |
| Vulnerable: |
Caldera rsync 2.1.1 -1 Caldera rsync 2.1 -1 Caldera OpenLinux Standard 1.2 Caldera OpenLinux Standard 1.1 Caldera OpenLinux Standard 1.0 |
| Not Vulnerable: |
Caldera rsync 2.3.1 |
Discussion
Caldera rsync Vulnerability
There is a design error in the Caldera rsync program versions 2.3.0 and previous which in some instances (dependant on rare configurations) will set users home directories to world readable. Should this occur any user on the system will be able to read & copy the contents of other users home directories.
There is a design error in the Caldera rsync program versions 2.3.0 and previous which in some instances (dependant on rare configurations) will set users home directories to world readable. Should this occur any user on the system will be able to read & copy the contents of other users home directories.
Exploit / POC
Caldera rsync Vulnerability
The problem happens if all of these conditions hold true:
1) the source file list contains exactly one filename and that is the name of an empty directory
2) the source directory name is specified on the command line as "somedir/" or "somedir/." or "." not as "somedir"
3) the destination directory doesn't exist
4) you have recursion and permission transfer enabled (the -a option will do this)
5) the working directory of the receiving process is not the destination directory (this happens when you do remote rsync transfers)
(the short summary is that you need to be transferring an empty directory into a non-existent directory)
The problem happens if all of these conditions hold true:
1) the source file list contains exactly one filename and that is the name of an empty directory
2) the source directory name is specified on the command line as "somedir/" or "somedir/." or "." not as "somedir"
3) the destination directory doesn't exist
4) you have recursion and permission transfer enabled (the -a option will do this)
5) the working directory of the receiving process is not the destination directory (this happens when you do remote rsync transfers)
(the short summary is that you need to be transferring an empty directory into a non-existent directory)
Solution / Fix
Caldera rsync Vulnerability
Solution:
The upgrade packages can be found on Caldera's FTP site at:
ftp://ftp.calderasystems.com/pub/OpenLinux/updates/2.2/current/RPMS/
The corresponding source code package can be found at:
ftp://ftp.calderaystems.com/pub/OpenLinux/updates/2.2/current/SRPMS
Solution:
The upgrade packages can be found on Caldera's FTP site at:
ftp://ftp.calderasystems.com/pub/OpenLinux/updates/2.2/current/RPMS/
The corresponding source code package can be found at:
ftp://ftp.calderaystems.com/pub/OpenLinux/updates/2.2/current/SRPMS
References
Caldera rsync Vulnerability
References:
References: