Ownership Escalation Vulnerability in rsnapshot: Local Users Can Access Arbitrary Files
Summary
DEBIAN-CVE-2005-1064: The copy_symlink function in rsnapshot 1.2.0 and 1.1.x before 1.1.7 changes the ownership of files that a symlink points to rather than the symlink itself, which allows local users to obtain access to arbitrary files. Affects rsnapshot versions < 1.2.1-1. Fixed in 1.2.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rsnapshot is a filesystem snapshot utility for making backups of local and remote systems. It utilizes rsync and hard links to create efficient backups. The tool is widely used for its simplicity and effectiveness in managing backup processes. However, a vulnerability in versions 1.2.0 and 1.1.x before 1.1.7 allows local users to change the ownership of files pointed to by symlinks, leading to unauthorized access to sensitive files.
Vulnerability Detail
The vulnerability, identified as DEBIAN-CVE-2005-1064, arises from the copy_symlink function in rsnapshot. Instead of changing the ownership of the symlink itself, it alters the ownership of the target files that the symlink points to. This flaw can be exploited by local users to gain unauthorized access to arbitrary files, potentially compromising the integrity and confidentiality of the system.
How To Fix
Minimum fixed version
1.2.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade rsnapshotTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict local user access to sensitive files and directories that may be affected by this vulnerability. This can be done by adjusting file permissions and ensuring that only authorized users have access to critical files.
Conclusion
The vulnerability in rsnapshot allows local users to change the ownership of files pointed to by symlinks, leading to potential unauthorized access. It is crucial to update to the patched version 1.2.1-1 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor for such vulnerabilities in your software.
See every vulnerability recorded for rsnapshot →
FAQ
Versions 1.2.0 and 1.1.x before 1.1.7 are affected by this vulnerability.
You can check your rsnapshot version by running 'rsnapshot -v' in the terminal. If your version is below 1.2.1-1, you are vulnerable.
Local users may gain unauthorized access to sensitive files, which could lead to data breaches or system compromise.
Yes, you can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. It requires only a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for rsnapshot.
