CVE-2014-9512 (retired)

Priority
Description
rsync 3.1.1 allows remote attackers to write to arbitrary files via a
symlink attack on a file in the synchronization path.
Notes
 mdeslaur> rsync 3.1.1 introduced invalid filename filtering to prevent
 mdeslaur> malicious servers from sending files outside of the specified
 mdeslaur> directory:
 mdeslaur> https://git.samba.org/?p=rsync.git;a=commit;h=4cad402ea8a91031f86c53961d78bb7f4f174790
 mdeslaur>
 mdeslaur> CVE-2014-9512 is about malicious servers being able to bypass
 mdeslaur> that filtering by changing paths.
 mdeslaur>
 mdeslaur> This is a security hardening feature that was added in 3.1.1.
 mdeslaur> Either the whole feature needs to be backported to versions
 mdeslaur> earlier than 3.1.1, or this issue doesn't apply to them.
 mdeslaur>
 mdeslaur> a second commit was later added:
 mdeslaur> https://git.samba.org/rsync.git/?p=rsync.git;a=commit;h=e12a6c087ca1eecdb8eae5977be239c24f4dd3d9
 mdeslaur> packages in vivid+ claim that this CVE is fixed, but are missing
 mdeslaur> the second commit
More Information

Updated: 2019-03-26 12:13:52 UTC (commit ccdecfcf0fead22bd291e5f4ea745a46872dcb15)