CVE-2004-0426 Path traversal in n/a

Medium 5.0 Published 30 Apr 2004 Updated 8 Aug 2024

Remote attackers can write files outside the module path in rsync daemons configured without chroot, requiring an upgrade to fix.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2004-0426?

CVE-2004-0426 is a medium-severity path traversal vulnerability in n/a, published on 30 Apr 2004. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

rsync before 2.6.1 does not properly sanitize paths when running a read/write daemon without using chroot, which allows remote attackers to write files outside of the module's path.

Which versions are affected by CVE-2004-0426?

It affects 1 product.

Linux distribution packages (8)

`rsync` Red Hat:enterprise_linux:3::as	All versions	`0:2.5.7-4.3E`
`rsync-debuginfo` Red Hat:enterprise_linux:3::as	All versions	`0:2.5.7-4.3E`
`rsync` Red Hat:enterprise_linux:3::desktop	All versions	`0:2.5.7-4.3E`
`rsync-debuginfo` Red Hat:enterprise_linux:3::desktop	All versions	`0:2.5.7-4.3E`
`rsync` Red Hat:enterprise_linux:3::es	All versions	`0:2.5.7-4.3E`
`rsync-debuginfo` Red Hat:enterprise_linux:3::es	All versions	`0:2.5.7-4.3E`
`rsync` Red Hat:enterprise_linux:3::ws	All versions	`0:2.5.7-4.3E`
`rsync-debuginfo` Red Hat:enterprise_linux:3::ws	All versions	`0:2.5.7-4.3E`

Products include Andrew Tridgell Rsync.

How do I fix CVE-2004-0426?

Upgrade to a fixed version.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2004-0426 being exploited?

There is no known exploitation of CVE-2004-0426 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2004-0426, DSA-499, GHSA-8hxr-8xgg-w97m, RHSA-2004:192.