CVE-2004-0426: Medium severity Andrew Tridgell Rsync vulnerability
Published Apr 30, 2004
·Updated
rsync before 2.6.1 does not properly sanitize paths when running a read/write daemon without using chroot, which allows remote attackers to write files outside of the module's path.
Affected Software
1 affected component
Andrew Tridgell Rsync<=2.6
Remediation
Patch Available
Patch Available
Event History
Apr 30, 2004
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-0426?
CVE-2004-0426 is considered to have a high severity due to the potential for remote attackers to write files outside the designated module path.
2
How do I fix CVE-2004-0426?
To fix CVE-2004-0426, upgrade to rsync version 2.6.1 or later, which addresses the path sanitization issue.
3
What software is affected by CVE-2004-0426?
CVE-2004-0426 affects rsync versions prior to 2.6.1.
4
Can CVE-2004-0426 be exploited remotely?
Yes, CVE-2004-0426 can be exploited remotely if the rsync daemon is configured without chroot.
5
What are the potential consequences of CVE-2004-0426?
The potential consequences of CVE-2004-0426 include unauthorized file writing and potential system compromise.