Critical Buffer Over-read Vulnerability in rsync Package
Summary
ALPINE-CVE-2017-16548: The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, which allows remote attackers to cause a denial of service (heap-based buffer ove... Affects rsync versions < 3.1.2-r7. Fixed in 3.1.2-r7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rsync is a widely used utility for efficiently transferring and synchronizing files across computer systems. It is known for its speed and flexibility, allowing users to perform incremental backups and mirror data. However, certain versions of rsync are vulnerable to a critical issue that can lead to denial of service and potential data exposure.
Vulnerability Detail
The vulnerability, identified as CVE-2017-16548, arises from the receive_xattr function in xattrs.c within rsync versions 3.1.2 and 3.1.3-development. This function fails to check for a trailing '\0' character in an extended attribute (xattr) name, which can be exploited by remote attackers. By sending specially crafted data to the rsync daemon, an attacker can trigger a heap-based buffer over-read, causing the application to crash and potentially leading to further unspecified impacts.
How To Fix
Minimum fixed version
3.1.2-r7
This is the first release that contains the fix.
sudo apk add --upgrade rsyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting access to the rsync daemon or disabling it until the package can be updated. This can be done by modifying the configuration to limit connections to trusted IP addresses only.
Conclusion
The rsync package has a critical vulnerability that can be exploited by remote attackers, leading to application crashes and potential data exposure. It is crucial to update to the patched version to mitigate these risks. Users should also consider using Vulert to monitor for vulnerabilities in their software.
See every vulnerability recorded for rsync →
FAQ
CVE-2017-16548 is a vulnerability in the rsync package that allows remote attackers to exploit a buffer over-read, leading to application crashes.
The affected versions include rsync 3.1.2 and 3.1.3-development.
The vulnerability can cause denial of service through application crashes and may expose sensitive data.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score for this vulnerability is 9.8, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for rsync.
