Ownership Change Vulnerability in rsnapshot: Local File Access Risk
Summary
CVE-2005-1064: The copy_symlink function in rsnapshot 1.2.0 and 1.1.x before 1.1.7 changes the ownership of files that a symlink points to rather than the symlink itself, which allows local users to obtain access to arbitrary files. Affects rsnapshot versions < 1.2.1-1. Fixed in 1.2.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rsnapshot is a filesystem snapshot utility for making backups of local and remote systems. It utilizes rsync and hard links to create efficient backups. The tool is designed to simplify the backup process while ensuring data integrity and ease of restoration. However, certain versions of rsnapshot are vulnerable to a flaw in the copy_symlink function, which can lead to unintended file access by local users.
Vulnerability Detail
The vulnerability arises from the copy_symlink function in rsnapshot versions 1.2.0 and 1.1.x prior to 1.1.7. Instead of changing the ownership of the symlink itself, the function alters the ownership of the files that the symlink points to. This behavior allows local users to gain access to arbitrary files, potentially leading to unauthorized data exposure or manipulation. The flaw is particularly concerning in multi-user environments where sensitive data may be accessible through symlinks.
How To Fix
Minimum fixed version
1.2.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade rsnapshotTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using symlinks in their backup configurations until the software is updated. Additionally, restricting access to the rsnapshot utility to trusted users can help mitigate the risk of unauthorized access.
Conclusion
The vulnerability in rsnapshot poses a significant risk to local file security due to improper handling of symlinks. Users are strongly advised to upgrade to the latest version to mitigate this risk. Additionally, employing workarounds can help protect sensitive data until the upgrade is completed.
See every vulnerability recorded for rsnapshot →
FAQ
The vulnerability affects rsnapshot versions 1.2.0 and 1.1.x prior to 1.1.7.
Local users may gain unauthorized access to files that they should not have access to, leading to data exposure or manipulation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
Yes, you can avoid using symlinks in your backup configurations and restrict access to the rsnapshot utility to trusted users.
More details can be found in the CVE database or through the provided source link in the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for rsnapshot.
