Test ID:	1.3.6.1.4.1.25623.1.0.53933
Category:	Slackware Local Security Checks
Title:	Slackware: Security Advisory (SSA:2004-124-01)
Summary:	The remote host is missing an update for the 'rsync' package(s) announced via the SSA:2004-124-01 advisory.
Description:	Summary: The remote host is missing an update for the 'rsync' package(s) announced via the SSA:2004-124-01 advisory. Vulnerability Insight: New rsync packages are available for Slackware 8.1, 9.0, 9.1, and -current to fix a security issue. When running an rsync server without the chroot option it is possible for an attacker to write outside of the allowed directory. Any sites running rsync in that mode should upgrade right away (and should probably look into using the chroot option as well). More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database: [link moved to references] Here are the details from the Slackware 9.1 ChangeLog: +--------------------------+ Sun May 2 17:16:41 PDT 2004 patches/packages/rsync-2.6.2-i486-1.tgz: Upgraded to rsync-2.6.2. Rsync before 2.6.1 does not properly sanitize paths when running a read/write daemon without using chroot, allowing remote attackers to write files outside of the module's path. For more details, see: [link moved to references] (* Security fix *) +--------------------------+ Affected Software/OS: 'rsync' package(s) on Slackware 8.1, Slackware 9.0, Slackware 9.1, Slackware current. Solution: Please install the updated package(s). CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2004-0426 BugTraq ID: 10247 http://www.securityfocus.com/bid/10247 Bugtraq: 20040521 [OpenPKG-SA-2004.025] OpenPKG Security Advisory (rsync) (Google Search) http://marc.info/?l=bugtraq&m=108515912212018&w=2 Computer Incident Advisory Center Bulletin: O-134 http://www.ciac.org/ciac/bulletins/o-134.shtml Computer Incident Advisory Center Bulletin: O-212 http://www.ciac.org/ciac/bulletins/o-212.shtml Debian Security Information: DSA-499 (Google Search) http://www.debian.org/security/2004/dsa-499 http://www.gentoo.org/security/en/glsa/glsa-200407-10.xml http://www.mandriva.com/security/advisories?name=MDKSA-2004:042 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9495 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A967 http://www.redhat.com/support/errata/RHSA-2004-192.html http://secunia.com/advisories/11514 http://secunia.com/advisories/11515 http://secunia.com/advisories/11523 http://secunia.com/advisories/11537 http://secunia.com/advisories/11583 http://secunia.com/advisories/11669 http://secunia.com/advisories/11688 http://secunia.com/advisories/11993 http://secunia.com/advisories/12054 http://www.slackware.org/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.403462 http://www.trustix.net/errata/misc/2004/TSL-2004-0024-rsync.asc.txt XForce ISS Database: rsync-write-files(16014) https://exchange.xforce.ibmcloud.com/vulnerabilities/16014
Copyright	Copyright (C) 2012 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.