Lsyncd 'default-rsyncssh.lua' Remote Command Injection Vulnerability

Bugtraq ID:	71179
Class:	Input Validation Error
CVE:	CVE-2014-8990
Remote:	Yes
Local:	No
Published:	Nov 19 2014 12:00AM
Updated:	Mar 07 2017 04:01AM
Credit:	ckowarzik
Vulnerable:	Lsyncd Lsyncd 2.0.7 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

Lsyncd 'default-rsyncssh.lua' Remote Command Injection Vulnerability

Lsyncd is prone to a remote command-injection vulnerability because it fails to properly sanitize user-supplied input.

An attacker may exploit this issue to execute arbitrary commands in context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

Lsyncd 'default-rsyncssh.lua' Remote Command Injection Vulnerability

Attackers can exploit this issue using readily available tools.

Lsyncd 'default-rsyncssh.lua' Remote Command Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Lsyncd 'default-rsyncssh.lua' Remote Command Injection Vulnerability

References:

• Backtick in filename make mv fail #220 (Lsyncd)
  
• Lsyncd Homepage (Lsyncd)
  
• lsyncd: Crash and/or code execution on `, $, " in file names (creshal)
  
• Sanitize mv arguments: (Lsyncd)