Rsync 3.5: an “extraordinary” release closes 33 vulnerabilities

Version 3.5 of Rsync, the popular open-source utility for synchronizing files and directories over a network, has been released. This update is hard to call routine: in the release notes (the NEWS file), the developers describe it as an “extraordinary release” — precisely because of the number of security issues it resolves.

In all, Rsync 3.5 closes 33 vulnerabilities. All of them were uncovered through a focused audit of the code responsible for path handling and the daemon protocol.

What exactly was fixed

Among the fixes are the ability to arbitrarily read and “shape” file transfers through symbolic links in operator-supplied input files, as well as arbitrary file writes and privilege escalation through symbolic links in output paths. Beyond that, a number of high-severity vulnerabilities (CVEs) were closed. In short, the update contains a whole layer of important security fixes, the full list of which is given in NEWS.

Because Rsync is widely used across a wide range of scenarios — from backups to mass file distribution on servers — the nature of the vulnerabilities (reading and writing arbitrary files, privilege escalation) makes this update especially significant for administrators running rsync daemons.

For those who build the utility themselves, the latest source code is available through Samba.org.

Source: Phoronix