Path Traversal and Access Restriction Bypass in rsync Daemon

CVE-2017-17434

What is CVE-2017-17434?

The rsync daemon in versions 3.1.2 and 3.1.3-development before December 3, 2017, is susceptible to vulnerabilities that fail to validate filename comparisons in the daemon_filter_list. Furthermore, these versions do not implement the sanitize_paths protection mechanism for pathnames located within 'xname follows' strings. As a result, remote attackers can exploit these flaws to bypass security restrictions, potentially accessing unintended files or directories.

References