Critical Vulnerabilities Discovered in Rsync File Synchronization Tool

Rsync, a widely used open-source utility for file synchronization and data transfer, has recently been found to contain six significant vulnerabilities. These flaws, affecting versions up to 3.3.0, pose serious security risks, including the potential for remote code execution and unauthorized data access.

Details of the Vulnerabilities

1. Heap Buffer Overflow (CVE-2024-12084): This critical flaw arises from improper handling of checksum lengths in the Rsync daemon, leading to out-of-bounds writes in the buffer. Exploiting this vulnerability can enable arbitrary code execution on the affected server.
2. Information Leak via Uninitialized Stack (CVE-2024-12085): An attacker can manipulate checksum lengths to force comparisons with uninitialized memory, leaking stack data byte by byte. This information leak can be leveraged to facilitate further attacks.
3. Server Leaks Arbitrary Client Files (CVE-2024-12086): A malicious server can enumerate and reconstruct arbitrary client files by exploiting manipulated checksum values during file transfer, leading to unauthorized data access.
4. Path Traversal via --inc-recursive Option (CVE-2024-12087): Inadequate symlink verification when using the --inc-recursive option allows malicious servers to write files outside the intended directories on the client, posing a risk of unauthorized file manipulation.
5. Bypass of --safe-links Option (CVE-2024-12088): Rsync fails to properly verify symbolic link destinations containing other links, resulting in path traversal and arbitrary file writes outside designated directories.
6. Symbolic Link Race Condition (CVE-2024-12747): A race condition in handling symbolic links may allow attackers to access sensitive files and escalate privileges on the affected system.

Impact and Risks

The combination of these vulnerabilities, particularly the heap buffer overflow and information leak, allows attackers with minimal access—such as anonymous read permissions—to execute arbitrary code on Rsync servers. This could lead to unauthorized access, data breaches, and potential system compromises.

Recommended Actions

To mitigate these risks, it is strongly advised to:

• Upgrade Rsync: Update to version 3.4.0, which addresses all six vulnerabilities. This version was released on January 14, 2025.
• Restrict Access: Configure Rsync daemons to require authentication, limiting exposure to potential attackers.
• Monitor Systems: Regularly audit and monitor systems for unusual activity that may indicate exploitation attempts.

Conclusion

These discoveries highlight the critical importance of maintaining up-to-date software and implementing robust security configurations. Administrators should act promptly to apply the necessary updates and safeguards to protect their systems from potential exploitation.

Sources

• Over 660,000 Rsync servers exposed to code execution attacks
• Rsync remote code execution and related vulnerability fixes available
• Rsync contains six vulnerabilities
• Six vulnerabilities discovered in rsync
• Rsync vulnerabilities allow remote code execution on servers, patch quickly
• RSYNC: 6 vulnerabilities - Openwall
• Severe Rsync vulnerabilities — CVSS 9.8 — risk RCE, data leaks