CVE-2014-2855: Input Validation
The checksecret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a user name which does not exist in the secrets file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2855?
CVE-2014-2855 is rated as a critical vulnerability due to its potential to cause denial of service through high CPU consumption.
How do I fix CVE-2014-2855?
To fix CVE-2014-2855, upgrade rsync to version 3.1.1 or later, or ensure that proper user management is in place to prevent invalid usernames.
What systems are affected by CVE-2014-2855?
CVE-2014-2855 affects rsync versions 3.1.0 and earlier, as well as specific earlier versions from 2.6.9 to 2.9.9.
What type of attack is possible with CVE-2014-2855?
CVE-2014-2855 allows remote attackers to launch denial-of-service attacks by using non-existent usernames that trigger an infinite loop.
Is there a workaround for CVE-2014-2855 if I cannot upgrade?
A temporary workaround for CVE-2014-2855 is to restrict access to rsync or to manage user authentication rigorously until an upgrade is possible.